December 2012 - Freeradius-Users - lists.freeradius.org

Max-Daily-Session Default value when user get disconnected
by John Doe 12 Dec '12

12 Dec '12

I need to know if you can add a default value such as 10 minutes each time a user logs out even though it was connected just one minute? Thanks in advance!!

1 0

Released IP info
by Raz Muhammad 12 Dec '12

12 Dec '12

Hi, I have a very simple query regarding following radius.log entry when a PPP session is disconnected following log entry is logged: "Sun Dec 9 20:46:05 2012 : Info: Released IP xx.xx.xx.xx (did cli 010010010 user xxx@xxx)" I would like to know what part of the configuration will enable/disable "Released IP" logging to radius.log file. I am using the "default" site file. It used to work for me before, but I had to make a change to disable simultaneous login feature. I disabled the radutmp feature in the sites default file in the "accounting" section and the "session" section. I also disabled "sqlippool" feature which is was left enabled for some reason, but we don't use any sqlippool feature. Regards Raz

2 2

Re: Eduroam & FreeRadius not working so well
by Alan Buxey 11 Dec '12

11 Dec '12

In the first instance, upgrade. There is a major security problem with 2.1.x release. Get 2.2.x onto your system asap. What are your NAS (cisco controllers) timeouts? Is this box a pure proxy or does it do authentication too? Have you enabled ciscos status-check system so it knows the RADIUS server isn't dead but just hasn't had a remote response yet? Around 67% of eduroam sites in the UK use freeradius alan

6 13

Setting up multiple NULL realms
by Chris Taylor 11 Dec '12

11 Dec '12

I am trying to collapse multiple domains into one RADIUS server (version 2-2.1.12-4.el5_8)with and LDAP backend. I have everything that has a realm suffix working I.E. username@domain-name, RADIUS will strip the username query the LDAP server (each domain has its own OU)and life is good. The problem I am running into is this. Each of the domains that I am collapsing had multiple users that would just connect with "username". I can setup the NULL realm but I have only been successful in getting it to work for one of my domains (domain-1.com) all others (I.E. domain-2.com, domain-3.com) will get a password reject error as it queries against that virtual server and subsequent OU, I have tried to setup multiple virtual servers in the realm NULL setup but that doesn't work. I have looked in the mailing list archives and searched the net but I have not been able to find anything related to this. Proxy.conf setup realm NULL { virtual_server = virtual.domain-1.com virtual_server = virtual.domain-1.com } Users file setup DEFAULT Realm == "NULL", Service-Type == Framed-User, Huntgroup-Name == bras Filter-Id = "NoRealm", Fall-Through = Yes What way should I be going about this? Thanks, Chris

2 1

Re: computer authentication
by Alan Buxey 10 Dec '12

10 Dec '12

Hi, you probably want to set peap as your default EAP type in eap.conf to save s couple of packets and a NAK. I don't see the ntlm_auth being called, have you edited the mschap module? The host name is rather short....are you sure this host is bound into an AD? alan

4 12

AW: Freeradius + LDAP
by Matthias Nagel 10 Dec '12

10 Dec '12

Hello, what exactly ist your problem? a) Do you want to know how to configure a web administration GUI (phpldapadmin) for your LDAP server? Then your problem is purly related to LDAP server, PHP and a web server. Hence, this is Thermometer wrong mailing list to ask for advice. b) Or do you want to know how to use a LDAP directory as a password backend? But then this question has nothing to do with phpldapadmin. You said, that RADIUS is already configured and running. Where are the user credentials stored at the moment? Matthias Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 ICQ: 499797758 Skype: nagmat84Brekler Custodio <brekler88(a)hotmail.com> hat geschrieben:Hello guys, i was wondering, anyone knows how to configure an LDAP (phpldapadmin) to work with freeradius ? I search all over the web and couldnt find a tutorial that teachs how to configure a simple DB to work with FR. The FR is configured already, its very simple, but the LDAP i cant handle.

1 0

Freeradius + LDAP
by Brekler Custodio 10 Dec '12

10 Dec '12

Hello guys, i was wondering, anyone knows how to configure an LDAP (phpldapadmin) to work with freeradius ?I search all over the web and couldnt find a tutorial that teachs how to configure a simple DB to work with FR.The FR is configured already, its very simple, but the LDAP i cant handle.

1 0

Re: open with mac authentication.
by Tzvika Gelber 09 Dec '12

09 Dec '12

Thank you very much. > > Tzvika Gelber wrote: > > I created a new user with the MAC address of the client as the user and > > password : > ... > > 00C0CA32A157 Cleartext-Password := "00C0CA32A157" > ... > > User-Name = "00c0ca32a157" > > User-Password = "00c0ca32a157" > > You do realize that they are different, right? > > The comparisons in the users file are case-sensitive. > > Alan DeKok. > > > ------------------------------ > > Message: 3 > Date: Sun, 9 Dec 2012 09:38:03 -0600 > From: Dan Letkeman <danletkeman(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: computer authentication > Message-ID: > <CAPY== > jnnw7fUHHpB1FvqPqMu8gQtuFERP_9WMWv__n7sVQec0w(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Thank you Matthew for the clarification I could successfully get the > windows 7 client to try and make a request (you defiantly need to have the > certs imported into exactly the correct spots). But now my debug log says > that its failing. This is a default 2.1.12 install with the switch added > to the clients.conf file. > > > rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=204, > length=180 > User-Name = "host/user(a)example.com" > Service-Type = Framed-User > Framed-MTU = 1500 > Called-Station-Id = "9C-AF-CA-F4-40-10" > Calling-Station-Id = "64-31-50-7D-72-DE" > EAP-Message = > 0x0201001a01686f73742f75736572406578616d706c652e636f6d > Message-Authenticator = 0x41f4a411366a244a23e887c859436d0b > NAS-Port-Type = Ethernet > NAS-Port = 50016 > NAS-Port-Id = "GigabitEthernet0/16" > NAS-IP-Address = 10.11.200.73 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] Looking up realm "example.com" for User-Name = "host/ > user(a)example.com" > [suffix] Found realm "example.com" > [suffix] Adding Stripped-User-Name = "host/user" > [suffix] Adding Realm = "example.com" > [suffix] Proxying request from user host/user to realm example.com > [suffix] Preparing to proxy authentication request to realm "example.com" > ++[suffix] returns updated > [eap] Request is supposed to be proxied to Realm example.com. Not doing > EAP. > ++[eap] returns noop > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > ++[pap] returns noop > WARNING: Empty pre-proxy section. Using default return values. > Sending Access-Request of id 231 to 127.0.0.1 port 1812 > User-Name = "host/user" > Service-Type = Framed-User > Framed-MTU = 1500 > Called-Station-Id = "9C-AF-CA-F4-40-10" > Calling-Station-Id = "64-31-50-7D-72-DE" > EAP-Message = > 0x0201001a01686f73742f75736572406578616d706c652e636f6d > Message-Authenticator = 0x00000000000000000000000000000000 > NAS-Port-Type = Ethernet > NAS-Port = 50016 > NAS-Port-Id = "GigabitEthernet0/16" > NAS-IP-Address = 10.11.200.73 > Proxy-State = 0x323034 > Proxying request 0 to home server 127.0.0.1 port 1812 > Sending Access-Request of id 231 to 127.0.0.1 port 1812 > User-Name = "host/user" > Service-Type = Framed-User > Framed-MTU = 1500 > Called-Station-Id = "9C-AF-CA-F4-40-10" > Calling-Station-Id = "64-31-50-7D-72-DE" > EAP-Message = > 0x0201001a01686f73742f75736572406578616d706c652e636f6d > Message-Authenticator = 0x00000000000000000000000000000000 > NAS-Port-Type = Ethernet > NAS-Port = 50016 > NAS-Port-Id = "GigabitEthernet0/16" > NAS-IP-Address = 10.11.200.73 > Proxy-State = 0x323034 > Going to the next request > Waking up in 0.9 seconds. > rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=231, > length=171 > User-Name = "host/user" > Service-Type = Framed-User > Framed-MTU = 1500 > Called-Station-Id = "9C-AF-CA-F4-40-10" > Calling-Station-Id = "64-31-50-7D-72-DE" > EAP-Message = > 0x0201001a01686f73742f75736572406578616d706c652e636f6d > Message-Authenticator = 0x0d22b2b1d5102149a8c1c731bc6613dd > NAS-Port-Type = Ethernet > NAS-Port = 50016 > NAS-Port-Id = "GigabitEthernet0/16" > NAS-IP-Address = 10.11.200.73 > Proxy-State = 0x323034 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] No '@' in User-Name = "host/user", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 1 length 26 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Identity does not match User-Name, setting from EAP Identity. > [eap] Failed in handler > ++[eap] returns invalid > Failed to authenticate the user. > Using Post-Auth-Type Reject > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> host/user > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 1 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 1 > Sending Access-Reject of id 231 to 127.0.0.1 port 1814 > Proxy-State = 0x323034 > Waking up in 4.9 seconds. > rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=231, > length=25 > Proxy-State = 0x323034 > # Executing section post-proxy from file /etc/raddb/sites-enabled/default > +- entering group post-proxy {...} > [eap] No pre-existing handler found > ++[eap] returns noop > Using Post-Auth-Type Reject > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> host/ > user(a)example.com > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Sending Access-Reject of id 204 to 10.11.200.73 port 1645 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 1 ID 231 with timestamp +14 > Cleaning up request 0 ID 204 with timestamp +14 > Ready to process requests. > > > > On Fri, Dec 7, 2012 at 2:23 PM, Matthew Newton <mcn4(a)leicester.ac.uk> > wrote: > > > On Fri, Dec 07, 2012 at 12:39:13PM -0600, Dan Letkeman wrote: > > > Sorry, I was not clean with my setup information. We do not have a > > domain, > > > these are stand alone windows 7 devices. We also have some tablets and > > > some linux boxes. Concern right now is the Windows 7 devices. I > didn't > > > know that you cannot do machine authentication without a domain.... > > > > You can, but you'll need to handle the certificates on the hosts > > manually. That's usually such a pain that the only real solution > > is to use AD. If you've got a small number of devices, or can > > write some other automated method of deploying certs, then it can > > be possible to handle. > > > > What you /can't/ do is both User auth (mschap - username + > > password) *and* Computer auth (certificates - EAP-TLS) in the same > > connection, as the default Windows supplicant, like most, doesn't > > support client certificates with PEAP (and user auth - mschap - > > needs to be inside PEAP). > > > > > User authentication in my environment is just not an option because all > > of > > > the devices need to have a connection to the network at all times even > if > > > nobody is logged in. Should I be using PEAP/EAP-TLS instead? > > > > There are no good reasons for doing PEAP/EAP-TLS unless you want > > to use SoH. PEAP adds overhead to the auth, with no added benefit. > > > > > If so do you know of any good setup documentation for that? > > > > I wrote up how to do PEAP/EAP-TLS a while back - you can find it > > here: http://q.asd.me.uk/pet > > > > That said - your connection is trying to do PEAP, so you've > > configured your client for either 'certifiates' or mschap inside > > PEAP. I forget the exact options in the interface, but you need to > > choose 'certificates' rather than 'PEAP', then select the client > > certificate that you want to auth with - which will be one that is > > signed by the same CA that the CA_file option in your FreeRADIUS > > eap.conf file points to. Make sure it's set to 'Computer' auth, > > not 'User' or 'User + Computer'. > > > > In theory, you'll then find that it Just Works. But the Windows > > config interface takes a bit of head scratching to get around > > until you understand what it's doing under the hood. > > > > Cheers > > > > Matthew > > > > > > -- > > Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> > > > > Systems Architect (UNIX and Networks), Network Services, > > I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom > > > > For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > >

1 0

Open+ MAC authentication failed.
by Tzvika Gelber 09 Dec '12

09 Dec '12

Hello, I'm trying to have a WiFi client to be authenticated in the OPEN+MAC method The AP is already known as a client of the Freeradius and any other form of Radius authentication i tried worked so far (WPA, WPA2) I'm using PEAP and the clients are Windows XP (if it makes any difference) I created a new user with the MAC address of the client as the user and password : (this is a none internet connected client) ###this is for OPEN+MAC AUTH 00C0CA32A157 Cleartext-Password := "00C0CA32A157" ####### and i keep getting this error when it's trying to get the IP from the DHCP Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.3 port 55965, id=5, length=128 User-Name = "00c0ca32a157" User-Password = "00c0ca32a157" Calling-Station-Id = "00-C0-CA-32-A1-57" NAS-IP-Address = 10.10.10.3 Called-Station-Id = "00-18-25-02-11-D2:103-mac" Service-Type = Framed-User NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Framed-MTU = 1400 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "00c0ca32a157", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 00c0ca32a157 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 5 to 10.10.10.3 port 55965 Waking up in 4.9 seconds. Cleaning up request 0 ID 5 with timestamp +12 Ready to process requests. what am i missing? or (however unlikely) freeradius does not support this type of authentication any more? Thank you -- ____ Sometimes you just glow in the dark...

2 1

(no subject)
by Jed Gainer 08 Dec '12

08 Dec '12

Hello everyone, in /etc/raddb/sql/mysql/counter.conf there is %b unix time value of beginning of reset period which makes things like sqlcounter counterChilliSpotMaxTotalOctetsDaily { counter-name = ChilliSpot-Max-Total-Octets-Daily check-name = CS-Total-Octets-Daily counter-type = data reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = daily query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } possible how would i get the value of %b for a user from say PHP so i can calc and show them how much bandwidth they have left?

2 3