May 2012 - Freeradius-Users - lists.freeradius.org

SNMP capabilities
by mimir 09 May '12

09 May '12

Hello, According to the document, freeradius supports SNMP and can send snmp trap. But, when I check the MIBs, I could not find event based definitions. According to my scenario, I want to send trap, For example 1-) When one of fail-server is dead ( with clear live also) 2-) When one of accounting packet which is proxied to another radius, and we can not get accounting response (with clear) 3-) via unlang and sql or ldap xlat, if query result is null. Is it possible? I appriceate if you refer any document. Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/SNMP-capabilities-tp5697299.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Session-Timeout Monitoring from db.daily
by yagizozen 09 May '12

09 May '12

Hello guys, I am using counter module as follows: counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout cache-size = 5000 } All the information of the users that connect and dc, is stored in the db.daily file I suppose. But I can not open the file with notepad and see which user had how many seconds of active sessions. I configured a user to use 1 hour per day. The user used 20 min of his 1 hour limit. Now where can I see that users remaining time to spent during that day?? I am not using regular accounting tables of the FR. I suppose that information is located that db.daily file but I can not see inside of it. Can you help me? Thank you very much -- View this message in context: http://freeradius.1045715.n5.nabble.com/Session-Timeout-Monitoring-from-db-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 11

unlang fails for some strange reason...
by Stefan Winter 09 May '12

09 May '12

Hi, at a client's site, I have to some chopping off parts of User-Name, pretty straightforward, but for some reason it doesn't work (2.1.12): In inner-tunnel, authenticate, MSCHAPv2 for PEAP: authenticate { Auth-Type MS-CHAP { if("%{Stripped-User-Name}" =~ /(....................).*/){ update request { SAMAccountName := "%{1}" } } else { update request { SAMAccountName := "%{Stripped-User-Name}" } } mschap } So, if the Stripped-User-Name is longer than 20 chars, chop it off and store it in SAMAccountName, otherwise, just store the full Stripped-User-Name in SAMAccountName. SAMAccountName is defined in the dictionary as an internal attribute: ATTRIBUTE SAMAccountName 3003 string During run-time, the following strange thing happens... # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if ("%{Stripped-User-Name}" =~ /(....................).*/) [mschapv2] expand: %{Stripped-User-Name} -> christian.test [mschapv2] ? Evaluating ("%{Stripped-User-Name}" =~ /(....................).*/) -> FALSE [mschapv2] ++? if ("%{Stripped-User-Name}" =~ /(....................).*/) -> FALSE [mschapv2] ++- entering else else {...} [mschapv2] expand: %{Stripped-User-Name} -> christian.test [mschapv2] +++[request] returns reject [mschapv2] ++- else else returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. So... short User-Name, the else path is taken, Stripped-User-Name expands nicely... and then, the "update request" group returns reject?!? I tried to use update control instead, which fails too, and used a non-internal attribute for that name as well. It just won't work. Is that maybe one of the known quirks in 2.1.12? Would using the current stable branch work better? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 5

Accessing radwho information or accounting request from rlm_perl
by eluna 09 May '12

09 May '12

I need to get the NAS-IP-Address attribute from the Accounting request and not from the Access request because because I am working with a WDS environment. These are the access and accounting requests: rad_recv: Access-Request packet from host 10.33.0.33 port 1645, id=36, length=211 User-Name = "user" Framed-MTU = 1400 Called-Station-Id = "00-19-56-B0-90-18" Calling-Station-Id = "00-1B-77-89-00-15" Cisco-AVPair = "ssid=SECURE" Service-Type = Login-User Message-Authenticator = 0x04664bdb23657848c1dfe846b6e162f6 EAP-Message = 0x020c002b190017030100208aa24d178243e49e8315219bac17f793f2b933eec5b NAS-Port-Type = Wireless-802.11 NAS-Port = 10677114 NAS-Port-Id = "10677114" State = 0xec6d109ee561091c536a9f8f173c1470 NAS-IP-Address = 10.33.0.33 rad_recv: Accounting-Request packet from host 10.33.11.33 port 1646, id=43, length=231 Acct-Session-Id = "000033C4" Called-Station-Id = "00-16-47-93-68-E2" Calling-Station-Id = "00-1B-77-89-00-15" Cisco-AVPair = "ssid=SECURE" Cisco-AVPair = "vlan-id=123" Cisco-AVPair = "nas-location=unspecified" User-Name = "user" Cisco-AVPair = "connect-progress=Call Up" Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "13454" NAS-Port = 13454 Service-Type = Framed-User NAS-IP-Address = 10.33.11.33 Acct-Delay-Time = 0 As you can see the NAS-IP-Address attributes are different, and I need a method to get the value of the accounting request because when I need to for example deauthenticate a user, i need to know what access point is is actually associated to. Any solutions or hints are very much appreciated. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Accessing-radwho-information-or-acc… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Translate characters
by Xbert_badstuber 08 May '12

08 May '12

Hello dear Freeradius friends! Im authenticating users by NAS-Port-Id by following format: ”1/1/4:1001.129”. In the scenario im using Service Router --> Freeradius --> Cisco ACS --> Active Directory. The problem is that Active directory cannot use “/” and “:” in the logon filed of the user when im trying to authenticate users. Is there anything I can do in the freeradius to change the characters to different ones? Example: To make “/” as “-“ and “:” as “_”. So the NAS-Port-ID would look like “1-1-4_1001.129” instead. Is it possible to translate characters in Freeradius? If possible, how do i make it? Best regards, Badstuber. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Translate-characters-tp5685645.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 9

mySQL user wifi authentication error on freeradius
by xadow20 08 May '12

08 May '12

Hi! I'm new to freeradius. My Setup is: Ubuntu Server 10.04 Freeradius 2.1.8 daloRADIUS 0.9-9 When I try to authenticate on AP wireless with a user on /etc/freeradius/users it succedd well. But When I create a user on daloradius it gives the output above, can anyone tell me what i'm doing wrong? Thanks [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - user [peap] Got tunneled request EAP-Message = 0x02070008016e736f server { PEAP: Got tunneled identity of user PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to user Sending tunneled request EAP-Message = 0x02070008016e736f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> u -- View this message in context: http://freeradius.1045715.n5.nabble.com/mySQL-user-wifi-authentication-erro… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

mySQL user wifi authentication error on freeradius
by xadow20 08 May '12

08 May '12

Hi! I'm new to freeradius. My Setup is: Ubuntu Server 10.04 Freeradius 2.1.8 daloRADIUS 0.9-9 When I try to authenticate on AP wireless with a user on /etc/freeradius/users it succedd well. But When I create a user on daloradius it gives the output above, can anyone tell me what i'm doing wrong? Thanks [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - user [peap] Got tunneled request EAP-Message = 0x02070008016e736f server { PEAP: Got tunneled identity of user PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to user Sending tunneled request EAP-Message = 0x02070008016e736f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> u -- View this message in context: http://freeradius.1045715.n5.nabble.com/mySQL-user-wifi-authentication-erro… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

problem about ldap-group attribute without users file
by Mohsen Saeedi 08 May '12

08 May '12

Hi I read more and more about my problem. but i didn't find any useful answer. I have freeradius-2.1.10 and i configured it with Active Directory. I know about openldap and radius profile and good attributes is exist under openldap for radius purpose. Now i'm able to find ldap-group with rlm_file module and with correct ldap module configuration. but i want to move our configuration from users to sql. i set everything on sql. such as nas configuration or profile definition. i defined some profile with needed attribute such as attribute is suitable for hotspot(coovachilli for example). but i'm not able to query ldap-group when i'm using rlm_sql and not rlm_file. how can i configure radius to get ldap-group query from AD to map AD group to sql profile? I know about unlang too. is it possible to write some unlang query for map ldap-group to sql profile? It's urget for me. please explain everything you know. I'm waiting for your answer man. Thanks

1 0

freeraduis LDAP error
by dhanushka ranasinghe 08 May '12

08 May '12

hi guys im getting this error when radius authenticating with LDAP, is there any way to sort the issue # Executing group from file /etc/freeradius/sites-enabled/default Thu May 3 11:50:26 2012 : Info: +- entering group PAP {...} Thu May 3 11:50:26 2012 : Info: [pap] ERROR: You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute! Thu May 3 11:50:26 2012 : Info: ++[pap] returns invalid Thu May 3 11:50:26 2012 : Info: Failed to authenticate the user. Thank You Dhanushka

6 15

NAS Client
by Shawky Skaff 07 May '12

07 May '12

I've setup a NAS client that being a cisco7301 and have entered this into clients.conf. When I run radiusd -X and do the following radtest eftel-test test123 27.34.225.253 1812 testing123, it fails, I don't get anything appearing on my debug radiusd -X screen. If I change the clients.conf back to the localhost client and do radtest eftel-test test123 27.34.225.33 1812 testing123 I get the below. 27.34.225.33 is the IP of my radius box. I'm pretty sure I'm doing something wrong or missing something, but would appreciate your help in telling me what I need to do Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. The NAS table has the following entry mysql> select * from nas; +----+-----------+-----------+-------+-------+-------------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+-----------+-----------+-------+-------+-------------+-----------+-------------+ | 2 | cisco7301 | C7301 | cisco | 1812 | ivox-radius | IVOX-RO | | +----+-----------+-----------+-------+-------+-------------+-----------+-------------+ 1 row in set (0.00 sec) My iptables firewall is disabled. [root@radius raddb]# netstat -antup | grep rad tcp 0 0 27.34.225.33:54306 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54307 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54310 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54308 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54309 27.34.225.33:3306 ESTABLISHED 4605/radiusd udp 0 0 0.0.0.0:1812 0.0.0.0:* 4605/radiusd udp 0 0 0.0.0.0:1813 0.0.0.0:* 4605/radiusd udp 0 0 0.0.0.0:1814 0.0.0.0:* 4605/radiusd Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.

3 11