February 2011 - Freeradius-Users - lists.freeradius.org

Possible typo in share/dictionary.dhcp
by Alexander Shikoff 07 Feb '11

07 Feb '11

Hello, if take a look on line 358 of share/dictionary.dhcp you may notice '=': VALUE DHCP-Parameter-Request-List DHCP-Keep-Alive-Interval 38 VALUE DHCP-Parameter-Request-List DHCP-Keep=Alive-Garbage 39 Is it possible typo? -- MINO-RIPE

3 3

issue with dialup.conf
by Tyller D 07 Feb '11

07 Feb '11

Hi I am having an issue, which may be the way I changed the dialup.conf or maybe its my logic. This is what I have done & am trying to achieve. freeradius is used to authenticate users at our hotspots, as we are using different nas devices and we must cater for them all i did this. in dictionary file I added an attribute called databank, then I created a perl script to check which type of nas the user is coming from and renaming databank to the correct attribute, now that works fine. Then on the stop request I need to update the value associated to databank to be (databank - (acctinputoctets+acctoutputoctets)). that way limiting users to only as much "data" as we stipulated in the begining. my problem is that it doesn't always update the databank value, I can see how much traffic a users used in his session (i.e. in the radacct table) so the accounting_stop_query & accounting_stop_query_alt are not failing, its just not updating the databank value in radcheck. here are the two queries accounting_stop_query = " \ UPDATE radacct,radcheck SET \ radacct.acctstoptime = '%S', \ radacct.acctsessiontime = '%{Acct-Session-Time}', \ radacct.acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ '%{%{Acct-Input-Octets}:-0}', \ radacct.acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ '%{%{Acct-Output-Octets}:-0}', \ radacct.acctterminatecause = '%{Acct-Terminate-Cause}', \ radcheck.value = radcheck.value - '%{Acct-Output-Octets}' - '%{Acct-Input-Octets}', \ radacct.acctstopdelay = '%{%{Acct-Delay-Time}:-0}', \ radacct.connectinfo_stop = '%{Connect-Info}' \ WHERE radacct.acctsessionid = '%{Acct-Session-Id}' \ AND radcheck.username = '%{SQL-User-Name}' \ AND radcheck.attribute = 'databank' \ AND radacct.username = '%{SQL-User-Name}' \ AND radacct.nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " \ UPDATE radacct,radcheck SET \ radacct.acctstoptime = '%S', \ radacct.acctsessiontime = '%{Acct-Session-Time}', \ radacct.acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ '%{%{Acct-Input-Octets}:-0}', \ radacct.acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ '%{%{Acct-Output-Octets}:-0}', \ radacct.acctterminatecause = '%{Acct-Terminate-Cause}', \ radacct.acctstopdelay = '%{%{Acct-Delay-Time}:-0}', \ radacct.connectinfo_stop = '%{Connect-Info}', \ radcheck.value = radcheck.value - '%{Acct-Output-Octets}' - '%{Acct-Input-Octets}' \ WHERE radacct.acctsessionid = '%{Acct-Session-Id}' \ AND radacct.username = '%{SQL-User-Name}' \ AND radacct.nasipaddress = '%{NAS-IP-Address}' \ AND radcheck.username = '%{SQL-User-Name}' \ AND radcheck.attribute = 'databank'" does anyone know how this can happen? could it be something to do with interim-updates (grasping at straws here). any help would be great. Thanks

3 12

Can't authenticate using LDAP (ldap+mysql+eap_ttls)
by Edgaras 07 Feb '11

07 Feb '11

Hello, I have configured freeradius (testing server) to try to authenticate using LDAP and if a user is not found in LDAP database, then try SQL. If I try authenticate using user found in SQL database - I get authorizated, authenticated and connected. But if I try authenticate as a user found in LDAP database - authentication fails in inner tunnel: server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test.user", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 6 length 79 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for test.user [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> test.user [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test.user) [ldap] expand: ou=Users, dc=xxxxxx, dc=lt -> ou=Users, dc=xxxxxx, dc=lt [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Users, dc=xxxxxx, dc=lt, with filter (uid=test.user) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user test.user authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (notfound) ? Evaluating (notfound) -> FALSE ++? if (notfound) -> FALSE ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for test.user with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel *It says "Found Auth-Type = EAP" although in sites-enabled/inner-tunnel I have uncommented: Auth-Type LDAP { ldap } By the way, if I try to autnenticate using same user via radtest server, of course, don't go into the inner-tunnel and so I get authenticated. I'm adding full radius log. Thanks.

2 2

radius authentication support for telnet server.
by vijay s sheelavantar 07 Feb '11

07 Feb '11

Thank you very very much Mr.Fajar. After making changes in /etc/pam.d/login it's working. authentication request is coming to freeradius server and authentication is successful. :)I need one more help, Please let me know the configuration file for FTP alo. i have crated a wu-ftpd file inside /etc/pam.d/ but it is not working. Thanks & Regards,Vijay S.

2 1

Re: radius authentication support for telnet server.
by vijay s sheelavantar 07 Feb '11

07 Feb '11

Thank you very very much Mr.Fajar. After making changes in /etc/pam.d/login it's working. authentication request is coming to freeradius server and authentication is successful. :) Thanks & Regards,Vijay S.

1 0

Problem ms-chapv2
by Влад Власов 07 Feb '11

07 Feb '11

Hello.Please help me.I try to setup FreeRadius (FreeBSD 7.2-RELEASE amd64)to setup as proxy.Windows clients can`t connect this default settings in pppoe connection (on tab security enabled all auth protocols) server send 691 error.If i disable all protocols except mschapv1 everything works fine without errors. Please tell me what I am doing wrong.All settings in the conf files by default, changed only proxy.conf and client.conf. I tried 2.1.10 ,2.1.9 versions. ----------------------------------------Auth Fail --------------------------------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1 port 61233, id=68, length=277 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x33297e1e26330d6c0df04a4b015b446c Acct-Session-Id = "7056520-TA233-3766-144" NAS-Port = 144 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d313434 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user@moco" MS-CHAP-Challenge = 0xbb1e68bfac6b679afbba56b6670fde86 MS-CHAP2-Response = 0x0100a945a3ba1dad2b9d2e95511c58f8464a0000000000000000aab387818928b6f430030d50fc68517c64c578458737b561 Mon Feb 7 10:28:40 2011 : Info: +- entering group authorize {...} Mon Feb 7 10:28:40 2011 : Info: ++[preprocess] returns ok Mon Feb 7 10:28:40 2011 : Info: ++[chap] returns noop Mon Feb 7 10:28:40 2011 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Mon Feb 7 10:28:40 2011 : Info: ++[mschap] returns ok Mon Feb 7 10:28:40 2011 : Info: ++[digest] returns noop Mon Feb 7 10:28:40 2011 : Info: [suffix] Looking up realm "moco" for User-Name = "test-user@moco" Mon Feb 7 10:28:40 2011 : Info: [suffix] Found realm "moco" Mon Feb 7 10:28:40 2011 : Info: [suffix] Adding Stripped-User-Name = "test-user" Mon Feb 7 10:28:40 2011 : Info: [suffix] Adding Realm = "moco" Mon Feb 7 10:28:40 2011 : Info: [suffix] Proxying request from user test-user to realm moco Mon Feb 7 10:28:40 2011 : Info: [suffix] Preparing to proxy authentication request to realm "moco" Mon Feb 7 10:28:40 2011 : Info: ++[suffix] returns updated Mon Feb 7 10:28:40 2011 : Info: [eap] No EAP-Message, not doing EAP Mon Feb 7 10:28:40 2011 : Info: ++[eap] returns noop Mon Feb 7 10:28:40 2011 : Info: [files] users: Matched entry DEFAULT at line 172 Mon Feb 7 10:28:40 2011 : Info: ++[files] returns ok Mon Feb 7 10:28:40 2011 : Info: ++[expiration] returns noop Mon Feb 7 10:28:40 2011 : Info: ++[logintime] returns noop Mon Feb 7 10:28:40 2011 : Info: ++[pap] returns noop Mon Feb 7 10:28:40 2011 : Info: WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 255 to 172.20.192.19 port 1812 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x00000000000000000000000000000000 Acct-Session-Id = "7056520-TA233-3766-144" NAS-Port = 144 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d313434 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user" MS-CHAP-Challenge = 0xbb1e68bfac6b679afbba56b6670fde86 MS-CHAP2-Response = 0x0100a945a3ba1dad2b9d2e95511c58f8464a0000000000000000aab387818928b6f430030d50fc68517c64c578458737b561 Proxy-State = 0x3638 Mon Feb 7 10:28:40 2011 : Info: Proxying request 65 to home server 172.20.192.19 port 1812 Sending Access-Request of id 255 to 172.20.192.19 port 1812 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x00000000000000000000000000000000 Acct-Session-Id = "7056520-TA233-3766-144" NAS-Port = 144 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d313434 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user" MS-CHAP-Challenge = 0xbb1e68bfac6b679afbba56b6670fde86 MS-CHAP2-Response = 0x0100a945a3ba1dad2b9d2e95511c58f8464a0000000000000000aab387818928b6f430030d50fc68517c64c578458737b561 Proxy-State = 0x3638 Mon Feb 7 10:28:40 2011 : Debug: Going to the next request Mon Feb 7 10:28:40 2011 : Debug: Waking up in 0.4 seconds. rad_recv: Access-Reject packet from host 172.20.192.19 port 1812, id=255, length=43 Reply-Message = "Authorization failed." Mon Feb 7 10:28:40 2011 : Info: +- entering group post-proxy {...} Mon Feb 7 10:28:40 2011 : Info: [eap] No pre-existing handler found Mon Feb 7 10:28:40 2011 : Info: ++[eap] returns noop Mon Feb 7 10:28:40 2011 : Auth: Login incorrect (Home Server says so): [test-user/<via Auth-Type = mschap>] (from client localhost port 144 cli 0022687293f7) Mon Feb 7 10:28:40 2011 : Info: Using Post-Auth-Type Reject Mon Feb 7 10:28:40 2011 : Info: +- entering group REJECT {...} Mon Feb 7 10:28:40 2011 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test-user@moco Mon Feb 7 10:28:40 2011 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Feb 7 10:28:40 2011 : Info: ++[attr_filter.access_reject] returns updated Mon Feb 7 10:28:40 2011 : Info: Delaying reject of request 65 for 1 seconds Mon Feb 7 10:28:40 2011 : Debug: Going to the next request Mon Feb 7 10:28:40 2011 : Debug: Waking up in 0.4 seconds. ---------------------------------------------------------------------------Auth OK---------------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1 port 51279, id=215, length=269 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x539b02bddfa871d7d243e10a9f9a5446 Acct-Session-Id = "7057178-TA233-3766-393" NAS-Port = 393 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d333933 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user@moco" MS-CHAP-Challenge = 0xbb1e68f8719180f3 MS-CHAP-Response = 0x0101000000000000000000000000000000000000000000000000d31328621ef9a79e6c1967d3fe23b98a82f34c9603465d55 Mon Feb 7 10:39:38 2011 : Info: +- entering group authorize {...} Mon Feb 7 10:39:38 2011 : Info: ++[preprocess] returns ok Mon Feb 7 10:39:38 2011 : Info: ++[chap] returns noop Mon Feb 7 10:39:38 2011 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Mon Feb 7 10:39:38 2011 : Info: ++[mschap] returns ok Mon Feb 7 10:39:38 2011 : Info: ++[digest] returns noop Mon Feb 7 10:39:38 2011 : Info: [suffix] Looking up realm "moco" for User-Name = "test-user@moco" Mon Feb 7 10:39:38 2011 : Info: [suffix] Found realm "moco" Mon Feb 7 10:39:38 2011 : Info: [suffix] Adding Stripped-User-Name = "test-user" Mon Feb 7 10:39:38 2011 : Info: [suffix] Adding Realm = "moco" Mon Feb 7 10:39:38 2011 : Info: [suffix] Proxying request from user test-user to realm moco Mon Feb 7 10:39:38 2011 : Info: [suffix] Preparing to proxy authentication request to realm "moco" Mon Feb 7 10:39:38 2011 : Info: ++[suffix] returns updated Mon Feb 7 10:39:38 2011 : Info: [eap] No EAP-Message, not doing EAP Mon Feb 7 10:39:38 2011 : Info: ++[eap] returns noop Mon Feb 7 10:39:38 2011 : Info: [files] users: Matched entry DEFAULT at line 172 Mon Feb 7 10:39:38 2011 : Info: ++[files] returns ok Mon Feb 7 10:39:38 2011 : Info: ++[expiration] returns noop Mon Feb 7 10:39:38 2011 : Info: ++[logintime] returns noop Mon Feb 7 10:39:38 2011 : Info: ++[pap] returns noop Mon Feb 7 10:39:38 2011 : Info: WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 132 to 172.20.192.19 port 1812 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x00000000000000000000000000000000 Acct-Session-Id = "7057178-TA233-3766-393" NAS-Port = 393 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d333933 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user" MS-CHAP-Challenge = 0xbb1e68f8719180f3 MS-CHAP-Response = 0x0101000000000000000000000000000000000000000000000000d31328621ef9a79e6c1967d3fe23b98a82f34c9603465d55 Proxy-State = 0x323135 Mon Feb 7 10:39:38 2011 : Info: Proxying request 24 to home server 172.20.192.19 port 1812 Sending Access-Request of id 132 to 172.20.192.19 port 1812 NAS-Identifier = "PPPoE.mk.loc" NAS-IP-Address = 172.20.192.4 Message-Authenticator = 0x00000000000000000000000000000000 Acct-Session-Id = "7057178-TA233-3766-393" NAS-Port = 393 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022687293f7" NAS-Port-Id = "vlan3766" Vendor-12341-Attr-12 = 0x54413233332d333736362d333933 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:22:68:72:93:f7" User-Name = "test-user" MS-CHAP-Challenge = 0xbb1e68f8719180f3 MS-CHAP-Response = 0x0101000000000000000000000000000000000000000000000000d31328621ef9a79e6c1967d3fe23b98a82f34c9603465d55 Proxy-State = 0x323135 Mon Feb 7 10:39:38 2011 : Debug: Going to the next request Mon Feb 7 10:39:38 2011 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 172.20.192.19 port 1812, id=132, length=703 Service-Type = Framed-User Framed-Protocol = PPP Session-Timeout = 864000 Acct-Interim-Interval = 180 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-CHAP-MPPE-Keys = 0x2e6b0d1ca7472bb173f893b5365eb36218b1a3efe287dd370000000000000000 Vendor-12341-Attr-6 = 0x38392e3233362e3139322e302f3138 Vendor-12341-Attr-6 = 0x38312e39352e3232342e302f3230 Vendor-12341-Attr-6 = 0x38392e3134362e36342e302f3138 Vendor-12341-Attr-6 = 0x38322e3231352e36342e302f3138 Vendor-12341-Attr-6 = 0x38332e36392e3132382e302f3139 Vendor-12341-Attr-6 = 0x38332e3232312e3136312e302f3234 Vendor-12341-Attr-6 = 0x38332e3232312e3136302e302f3139 Vendor-12341-Attr-6 = 0x3231372e32392e3131322e302f3230 Vendor-12341-Attr-6 = 0x38342e35342e36342e302f3138 Vendor-12341-Attr-6 = 0x38352e3131372e3232342e302f3139 Vendor-12341-Attr-6 = 0x38372e3233372e3233322e302f3231 Vendor-12341-Attr-6 = 0x39312e3138382e3132382e302f3139 Vendor-12341-Attr-6 = 0x39312e3139362e37362e302f3232 Vendor-12341-Attr-6 = 0x3231332e3230362e33322e302f3139 Vendor-12341-Attr-6 = 0x3231372e31322e38302e302f3230 Vendor-12341-Attr-6 = 0x3139352e3135382e302e302f3139 Vendor-12341-Attr-6 = 0x3139332e32372e3230362e302f3233 Vendor-12341-Attr-6 = 0x37372e3232302e3139322e302f3139 Vendor-12341-Attr-6 = 0x38302e38302e3230382e302f3230 Vendor-12341-Attr-6 = 0x3231332e3233302e36342e302f3138 Vendor-12341-Attr-6 = 0x39312e3230342e3233362e302f3232 Vendor-12341-Attr-6 = 0x36322e3230392e3132382e302f3230 Vendor-12341-Attr-7 = 0x696e23313d616c6c20726174652d6c696d697420313032343030302031323830303020313238303030 Vendor-12341-Attr-7 = 0x6f757423313d616c6c20726174652d6c696d697420313032343030302031323830303020313238303030 Mon Feb 7 10:39:38 2011 : Info: +- entering group post-proxy {...} Mon Feb 7 10:39:38 2011 : Info: [eap] No pre-existing handler found Mon Feb 7 10:39:38 2011 : Info: ++[eap] returns noop Mon Feb 7 10:39:38 2011 : Info: Found Auth-Type = MSCHAP Mon Feb 7 10:39:38 2011 : Info: Found Auth-Type = Accept Mon Feb 7 10:39:38 2011 : Error: Warning: Found 2 auth-types on request for user 'test-user' Mon Feb 7 10:39:38 2011 : Info: Auth-Type = Accept, accepting the user Mon Feb 7 10:39:38 2011 : Auth: Login OK: [test-user/<via Auth-Type = mschap>] (from client localhost port 393 cli 0022687293f7) Mon Feb 7 10:39:38 2011 : Info: +- entering group post-auth {...} Mon Feb 7 10:39:38 2011 : Info: ++[exec] returns noop Sending Access-Accept of id 215 to 127.0.0.1 port 51279 Service-Type = Framed-User Framed-Protocol = PPP Session-Timeout = 864000 Acct-Interim-Interval = 180 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-CHAP-MPPE-Keys = 0x2e6b0d1ca7472bb173f893b5365eb36218b1a3efe287dd370000000000000000 Vendor-12341-Attr-6 = 0x38392e3233362e3139322e302f3138 Vendor-12341-Attr-6 = 0x38312e39352e3232342e302f3230 Vendor-12341-Attr-6 = 0x38392e3134362e36342e302f3138 Vendor-12341-Attr-6 = 0x38322e3231352e36342e302f3138 Vendor-12341-Attr-6 = 0x38332e36392e3132382e302f3139 Vendor-12341-Attr-6 = 0x38332e3232312e3136312e302f3234 Vendor-12341-Attr-6 = 0x38332e3232312e3136302e302f3139 Vendor-12341-Attr-6 = 0x3231372e32392e3131322e302f3230 Vendor-12341-Attr-6 = 0x38342e35342e36342e302f3138 Vendor-12341-Attr-6 = 0x38352e3131372e3232342e302f3139 Vendor-12341-Attr-6 = 0x38372e3233372e3233322e302f3231 Vendor-12341-Attr-6 = 0x39312e3138382e3132382e302f3139 Vendor-12341-Attr-6 = 0x39312e3139362e37362e302f3232 Vendor-12341-Attr-6 = 0x3231332e3230362e33322e302f3139 Vendor-12341-Attr-6 = 0x3231372e31322e38302e302f3230 Vendor-12341-Attr-6 = 0x3139352e3135382e302e302f3139 Vendor-12341-Attr-6 = 0x3139332e32372e3230362e302f3233 Vendor-12341-Attr-6 = 0x37372e3232302e3139322e302f3139 Vendor-12341-Attr-6 = 0x38302e38302e3230382e302f3230 Vendor-12341-Attr-6 = 0x3231332e3233302e36342e302f3138 Vendor-12341-Attr-6 = 0x39312e3230342e3233362e302f3232 Vendor-12341-Attr-6 = 0x36322e3230392e3132382e302f3230 Vendor-12341-Attr-7 = 0x696e23313d616c6c20726174652d6c696d697420313032343030302031323830303020313238303030 Vendor-12341-Attr-7 = 0x6f757423313d616c6c20726174652d6c696d697420313032343030302031323830303020313238303030 Mon Feb 7 10:39:38 2011 : Info: Finished request 24. Mon Feb 7 10:39:38 2011 : Debug: Going to the next request

2 1

Freeradius + Mysql + Enterasys management-access
by Yücel Türkistan 07 Feb '11

07 Feb '11

Hello, I use FreeRADIUS version 2.1.3 with backend MySQL. It's working very good except this issue: When i try to use auth by Enterasys switch for management-access, Enterasys switch fails with login but FreeRADIUS says "Auth: Login OK:..." I searched on net and found that i have to add a Filter-Id with value Enterasys:version=1:mgmt=su But i could not find how to add this Filter-Id to mysql table. Can anyone help me please to solve this problem? Thanks a lot. -- King Regards Yucel

4 5

free radius implementation for big ISP
by Mohamad A 07 Feb '11

07 Feb '11

Hello, I'm working for big ISP and we have over 150 NASes all over the country and over 200,000 Internet subscribers. currently we are using one of those proprietary Radius servers available in the market. But the problem is current software even with very up-to-date hardware can not support our increasing radius requests from all over the country although we have installed 5 separate server (as our current software does not support spiting database over multiple servers) completely independent from each other and it's is very weak point of our network. As I'm currently using FreeRadius for Login into servers and NAS via telnet and also another instance for backup (this radius server accepts every request from known clients), I decided to study the possibilities of other available radius servers those would be able to address our needs and as I think you already know ended-up to FreeRadius! So I decided to post this in the mailing list to see if any one already have such a big implementation and also ask for help in later states if we go for FreeRadius. Our need are (least) : 1. Handling about 100,000 acc requests and 10,000 auth requests hourly! 2. Accounting 3. Control and limit user traffic. 4. Control and limit user concurrent logins. 5. CoA for changing user speed over different times of day. 6. CoA to disconnect user when the account validation is over (eg. Traffic quota exceeds). 7. Calculate traffic usage differently depending on day-time (ie. our service in nights does not calculate any traffic or some times as half for users). 8. Tracking online users and disconnect user if Accounting packet is not received in prefixed amount of time (currently 10 mins). 9. Spliting database traffic over multiple servers. 10. Designing one interface to manage all users. Do you really suggest to switch to FreeRadius or stick to the current problematic solution ? (sorry for my poor English :) Regards, M

2 2

Re: radius authentication support for telnet server.
by vijay s sheelavantar 06 Feb '11

06 Feb '11

Hi Friends, I am trying to authenticate telnet users using free radius. on my system telnet is running as follows.ps -ef | grep xinetdroot 22737 1 0 10:52 ? 00:00:00 /usr/sbin/xinetd -reuseroot 22864 18178 0 10:57 pts/1 00:00:00 grep xinetd I have tried by creating "telnet", "xinetd" files in /etc/pam.d/ folder. I have included "auth sufficient pam_radius_auth.so debug" in these files. I have added this line to /etc/pam.d/other file also. I don't have /etc/pam.d/common-auth file i think "other" file is for the same. but i am not getting the request form pam_radius_auth.so client to my radius server running on different machine. when i checked the log files at client side it shows as below. Feb 7 10:53:35 (none) xinetd[22737]: START: telnet pid=22769 from=::ffff:10.1.1.101Feb 7 10:53:44 (none) login(pam_unix)[22770]: account user has password changed in futureFeb 7 10:53:44 (none) login(pam_unix)[22770]: session opened for user user by (uid=0)Feb 7 10:53:44 (none) login[22770]: ROOT LOGIN on `pts/4' from `10.1.1.101' please let me know how can i authenticate telnet users with radius server. Thanks & RegardsVijay S.

2 1

Re: Radius Client UDP port selection
by vijay s sheelavantar 06 Feb '11

06 Feb '11

Thank you very much Mr.Brian. :)

1 0