April 2011 - Freeradius-Users - lists.freeradius.org

Custom sql post-auth help
by Trey Briggs 05 Apr '11

05 Apr '11

Hi, I'm trying to get similar logging in mysql to what you see with: log { ... auth = yes auth_badpass = yes auth_goodpass = yes } "Login OK: [<user>/<pass>] (from client <client> port 0)" I've found how to log accepts and rejects using the sql module in the post-auth section, but I'm unsure how to insert the client info (name or IP is fine). Here's what I've tried: sql/mysql/dialup.conf postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate, nas_ip, nas_id) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{NAS-Identifier}', \ '%{reply:Packet-Type}', '%S', \ '%{NAS-IP-Address}')" It doesn't appear that the "NAS-IP-Address" has any data at this point in the chain, the debug output shows this as the query run: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, nas_id, reply, authdate, nas_ip) VALUES ( 'XXXXX', 'xxxx', 'YYYYY', 'Access-Accept', '2011-04-04 13:56:33', '') Is there another variable I can use to get the client name/ip inserted into the db? Is this even possible in post-auth? Thanks in advance, -- Trey Briggs

2 1

How to make a NAS(Cisco) send MSCHAP request
by Raheel Itrat 04 Apr '11

04 Apr '11

Hello, To all Cisco guys out there how can I make a NAS(Cisco 2960 switch) to send MSCHAP requests to FR server instead of PAP requests. Thanks, Raheel

2 1

unlang question
by Omer Faruk SEN 04 Apr '11

04 Apr '11

I want to insert Quintum-h323-remote-address value to radacct table at sql/<db>/dialup.conf i have made my modifications but i see entries like h323-remote-address=3D10.241.1.202 which is h323-remote-address=10.241.1.202 but I only want 10.241.1.202 (IP address) My entry at details file: Quintum-h323-remote-address = "h323-remote-address=10.100.250.150" I want 10.100.250.150 PS: I know there is a hack for quintum but for some reason I am forced not to use it. I have looked at unlang but unable to find a solution for that. Regards.

2 1

Re: Strip off the domain part from the User-Name
by Thomas Wunder 04 Apr '11

04 Apr '11

Hi On Friday 25 March 2011 15:42:30 you wrote: > In which case, you *must* enable "with_ntdomain_hack = yes" As you suggested I changed the 'with_ntdomain_hack' option to 'yes' in four different locations (modules/preprocess, modules/mschap, eap.conf, modules/inner-eap) but still it doesn't work. I get the following error message (for a full debug log see attachment) which is new: ++[ldap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [tom1] (from client swtswitch01 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled I'm obviously missing something but I can't seem to find out what it is... Any ideas? Regards Tom

2 8

Creating freeRADIUS extensions (beginner)
by Tiberiu Breana 03 Apr '11

03 Apr '11

Hello. I'm doing my thesis project on advanced authentication techniques. I want to use freeRADIUS to implement extensions regarding one or more of the following: 1)Location-based authentication 2)Prepay codes for timed access 3)QoS parameters (allocate network resources according to the user's services) Do you think these extensions are 'doable' for a beginner? What are the major steps in implementing a new module? From what I've understood so far, I have to create a .c file and add some attributes to the dictionary. Is implementing new message types difficult? (does the finite-state machine need to be modified?) Any advice/information/tips are greatly welcome. Thanks!

2 1

Re: Shared Secret / UAM Secret
by CP 02 Apr '11

02 Apr '11

nobody can help? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Shared-Secret-UAM-Secret-tp4275444p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

AD Integration -No Auth Type
by Raheel Itrat 02 Apr '11

02 Apr '11

Hi, Trying to integrate AD with FR I have successfully joined the domain and also ntlm_auth status as per attached file is OK But when I telnet to my cisco switch I get the subjected error. The relevant files are attached. Im using FR 2.1.0 for 2.1.0 version what elso do i need to do except enabling and editing ntlm_auth line in the mschap module as per Alan's deploying radius tutorial. KIndly go through attached files and help me in this regard Regards, Raheel

4 4

Ignoring reqest from unknown client
by Raheel Itrat 02 Apr '11

02 Apr '11

Hi, I am getting the subjected error when I try to authenticate. I am attaching the relevant files. btw is freeradius-X and radiusd-X same thing? ......My ubuntu doesnt seem to recognize radiusd command root@radius:~# radiusd -X The program 'radiusd' can be found in the following packages: * radiusd-livingston * xtradius * yardradius Try: apt-get install <selected package> radiusd: command not found Regards, Raheel

4 5

Dial up error and freeraius is down
by Robin 01 Apr '11

01 Apr '11

Hi Friends, I met a problem with FreeRADIUS2.1.9 (Mysql+centos, about 500 pppoe users)as below: In general, I found some users couldn't dial to radius and log information as below - Fri Apr 1 19:22:09 2011 : Error: Discarding duplicate request from client mpth12 port 40039 - ID: 129 due to unfinished request 10524 - Fri Apr 1 19:22:10 2011 : Error: Discarding conflicting packet from client mpth12 port 40039 - ID: 129 due to recent request 10524. - I have two guesses: - Brand width is insufficient from pppoe server to radius server; - Server running radius of capability is insufficient. Could you help me? Thank you very much. Robin

4 6

Oracle reconnection for free radius
by Jaikanth Krishnaswamy 01 Apr '11

01 Apr '11

Hi, I have setup free radius freeradius-server-2.1.10 with an oracle back end as suggested on in the documentation. Is there a setting for Oracle connectivity retries from the free- radius S/W ie. If Oracle Server is down does freeradius retry connection after a configurable amount of time?If so which config file is this in? Please advice. Thanks JK

1 0