- Freeradius-Users - lists.freeradius.org

Accessing radwho information or accounting request from rlm_perl
by eluna 09 May '12

09 May '12

I need to get the NAS-IP-Address attribute from the Accounting request and not from the Access request because because I am working with a WDS environment. These are the access and accounting requests: rad_recv: Access-Request packet from host 10.33.0.33 port 1645, id=36, length=211 User-Name = "user" Framed-MTU = 1400 Called-Station-Id = "00-19-56-B0-90-18" Calling-Station-Id = "00-1B-77-89-00-15" Cisco-AVPair = "ssid=SECURE" Service-Type = Login-User Message-Authenticator = 0x04664bdb23657848c1dfe846b6e162f6 EAP-Message = 0x020c002b190017030100208aa24d178243e49e8315219bac17f793f2b933eec5b NAS-Port-Type = Wireless-802.11 NAS-Port = 10677114 NAS-Port-Id = "10677114" State = 0xec6d109ee561091c536a9f8f173c1470 NAS-IP-Address = 10.33.0.33 rad_recv: Accounting-Request packet from host 10.33.11.33 port 1646, id=43, length=231 Acct-Session-Id = "000033C4" Called-Station-Id = "00-16-47-93-68-E2" Calling-Station-Id = "00-1B-77-89-00-15" Cisco-AVPair = "ssid=SECURE" Cisco-AVPair = "vlan-id=123" Cisco-AVPair = "nas-location=unspecified" User-Name = "user" Cisco-AVPair = "connect-progress=Call Up" Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "13454" NAS-Port = 13454 Service-Type = Framed-User NAS-IP-Address = 10.33.11.33 Acct-Delay-Time = 0 As you can see the NAS-IP-Address attributes are different, and I need a method to get the value of the accounting request because when I need to for example deauthenticate a user, i need to know what access point is is actually associated to. Any solutions or hints are very much appreciated. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Accessing-radwho-information-or-acc… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Translate characters
by Xbert_badstuber 08 May '12

08 May '12

Hello dear Freeradius friends! Im authenticating users by NAS-Port-Id by following format: ”1/1/4:1001.129”. In the scenario im using Service Router --> Freeradius --> Cisco ACS --> Active Directory. The problem is that Active directory cannot use “/” and “:” in the logon filed of the user when im trying to authenticate users. Is there anything I can do in the freeradius to change the characters to different ones? Example: To make “/” as “-“ and “:” as “_”. So the NAS-Port-ID would look like “1-1-4_1001.129” instead. Is it possible to translate characters in Freeradius? If possible, how do i make it? Best regards, Badstuber. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Translate-characters-tp5685645.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 9

mySQL user wifi authentication error on freeradius
by xadow20 08 May '12

08 May '12

Hi! I'm new to freeradius. My Setup is: Ubuntu Server 10.04 Freeradius 2.1.8 daloRADIUS 0.9-9 When I try to authenticate on AP wireless with a user on /etc/freeradius/users it succedd well. But When I create a user on daloradius it gives the output above, can anyone tell me what i'm doing wrong? Thanks [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - user [peap] Got tunneled request EAP-Message = 0x02070008016e736f server { PEAP: Got tunneled identity of user PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to user Sending tunneled request EAP-Message = 0x02070008016e736f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> u -- View this message in context: http://freeradius.1045715.n5.nabble.com/mySQL-user-wifi-authentication-erro… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

mySQL user wifi authentication error on freeradius
by xadow20 08 May '12

08 May '12

Hi! I'm new to freeradius. My Setup is: Ubuntu Server 10.04 Freeradius 2.1.8 daloRADIUS 0.9-9 When I try to authenticate on AP wireless with a user on /etc/freeradius/users it succedd well. But When I create a user on daloradius it gives the output above, can anyone tell me what i'm doing wrong? Thanks [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - user [peap] Got tunneled request EAP-Message = 0x02070008016e736f server { PEAP: Got tunneled identity of user PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to user Sending tunneled request EAP-Message = 0x02070008016e736f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> u -- View this message in context: http://freeradius.1045715.n5.nabble.com/mySQL-user-wifi-authentication-erro… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

problem about ldap-group attribute without users file
by Mohsen Saeedi 08 May '12

08 May '12

Hi I read more and more about my problem. but i didn't find any useful answer. I have freeradius-2.1.10 and i configured it with Active Directory. I know about openldap and radius profile and good attributes is exist under openldap for radius purpose. Now i'm able to find ldap-group with rlm_file module and with correct ldap module configuration. but i want to move our configuration from users to sql. i set everything on sql. such as nas configuration or profile definition. i defined some profile with needed attribute such as attribute is suitable for hotspot(coovachilli for example). but i'm not able to query ldap-group when i'm using rlm_sql and not rlm_file. how can i configure radius to get ldap-group query from AD to map AD group to sql profile? I know about unlang too. is it possible to write some unlang query for map ldap-group to sql profile? It's urget for me. please explain everything you know. I'm waiting for your answer man. Thanks

1 0

freeraduis LDAP error
by dhanushka ranasinghe 08 May '12

08 May '12

hi guys im getting this error when radius authenticating with LDAP, is there any way to sort the issue # Executing group from file /etc/freeradius/sites-enabled/default Thu May 3 11:50:26 2012 : Info: +- entering group PAP {...} Thu May 3 11:50:26 2012 : Info: [pap] ERROR: You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute! Thu May 3 11:50:26 2012 : Info: ++[pap] returns invalid Thu May 3 11:50:26 2012 : Info: Failed to authenticate the user. Thank You Dhanushka

6 15

NAS Client
by Shawky Skaff 08 May '12

08 May '12

I've setup a NAS client that being a cisco7301 and have entered this into clients.conf. When I run radiusd -X and do the following radtest eftel-test test123 27.34.225.253 1812 testing123, it fails, I don't get anything appearing on my debug radiusd -X screen. If I change the clients.conf back to the localhost client and do radtest eftel-test test123 27.34.225.33 1812 testing123 I get the below. 27.34.225.33 is the IP of my radius box. I'm pretty sure I'm doing something wrong or missing something, but would appreciate your help in telling me what I need to do Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. The NAS table has the following entry mysql> select * from nas; +----+-----------+-----------+-------+-------+-------------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+-----------+-----------+-------+-------+-------------+-----------+-------------+ | 2 | cisco7301 | C7301 | cisco | 1812 | ivox-radius | IVOX-RO | | +----+-----------+-----------+-------+-------+-------------+-----------+-------------+ 1 row in set (0.00 sec) My iptables firewall is disabled. [root@radius raddb]# netstat -antup | grep rad tcp 0 0 27.34.225.33:54306 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54307 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54310 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54308 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54309 27.34.225.33:3306 ESTABLISHED 4605/radiusd udp 0 0 0.0.0.0:1812 0.0.0.0:* 4605/radiusd udp 0 0 0.0.0.0:1813 0.0.0.0:* 4605/radiusd udp 0 0 0.0.0.0:1814 0.0.0.0:* 4605/radiusd Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.

3 11

fail to start server
by jerry kwajaffa 07 May '12

07 May '12

Gd day, please i need your help, i install freeradius 2.1.12 on centOS 6.2, when ever i try to strart that server o debug, i.e radius -X it gives the following Failed binding to /var/run/radiusd/radiusd.sock: No such file or directory am i to create the file on that path ? pls i need help

2 1

Re: Freeradius-Users Digest, Vol 85, Issue 14 - Use case Radclient
by ulrich ramassamy 07 May '12

07 May '12

Hello everybody, I have one problem with an options of raclient tool's: I have create a little script: (I have one file named "file1") and in this file, I have 3 columns (IP, MSISDN,Acct-Session-Id): IP MSISDN Acct-Session-Id 1.1.1.1 3368894XXXX 500A02B2382F3D8E 2.2.2.2 3368739XXXX 500A02B5383F27D9 ###### BEGIN ###### old_IFS=$IFS IFS=$'\n' for i in `cat file1` do echo $i | gawk '{print "Acct-Session-Id="$3"\n""NAS-IP-Address="$1}' | radclient *-p 100* -r 2 -x 3.3.3.3:3799 disconnect ''secret'' done IFS=$old_IFS ###### END ###### But in this script the parameter *-p *is not used!!!! root@ulrich-Pod1:/etc/freeradius# old_IFS=$IFS root@ulrich-Pod1:/etc/freeradius# IFS=$'\n' root@ulrich-Pod1:/etc/freeradius# root@ulrich-Pod1:/etc/freeradius# for i in `cat file1` > do echo $i | gawk '{print "Acct-Session-Id="$3"\n""NAS-IP-Address="$1}' | radclient -p 100 -r 2 -x 3.3.3.3:3799 disconnect ''secret'' > done Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 radclient: no response from server for ID 127 socket 3 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 radclient: no response from server for ID 206 socket 3 root@ulrich-Pod1:/etc/freeradius# root@ulrich-Pod1:/etc/freeradius# IFS=$old_IFS The problem "radclient: no response from server" it's normal because it's just a test and the "disconnect server" it's not configure!! But the problem is that I specify in the script that we can send up to 100 requests in parallel but I see that the script sends only one request at a time, and if there is no answer two other requests is sent In the man of radclient i have this: -p num_requests_in_parallel Send num_requests_in_parallel, without waiting for a response for each one. By default, radclient sends the first request it has read, waits for the response, and once the response is received, sends the second request in its list. This option allows you to send many requests at simultaneously. Once num_requests_in_parallel are sent, radclient waits for all of the responses to arrive (or for the requests to time out), before sending any more packets. This option permits you to discover the maximum load accepted by a RADIUS server. I thins it's the same problem with option -n! It's a Bug!!!!!!!???? Best Regards Ulrich 2012/5/7 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. radclient (ulrich ramassamy) > 2. Re: multiple ldap servers::solved:: (jeff donovan) > 3. Sync ldap-group with sql profiles (Mohsen Saeedi) > 4. NAS Client (Shawky Skaff) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 6 May 2012 19:46:06 +0200 > From: ulrich ramassamy <ramassamy.ulrich(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: radclient > Message-ID: > <CAKYkJTp9Fi6kZAwSptUBZZXCq3To1B6jSrkTWvw5SRP=ZW_STw(a)mail.gmail.com > > > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > > I am writing you because I need your help on using the tool "radclient". > I need to send Packet Of Disconnect (POD). I have one file (for example > name "file1") and in this file, I have 3 columns (IP, MSISDN, > Acct-Session-Id): > > IP MSISDN Acct-Session-Id > 1.1.1.1 3368894XXXX 500A02B2382F3D8E > 2.2.2.2 3368739XXXX 500A02B5383F27D9 > > I read on this site: "http://wiki.freeradius.org/Disconnect-Messages" and > the proposed solution tells us to insert in a file "packet.txt" the > attributes that we wish send. In this method we have to create one file for > one POD. :( > > Now I want to use the file "file1" by selecting the attibutes to send POD > one to one in one command (linux command) like this : > > Sending Disconnect-Request of id 214 to 1.1.1.1 port 3799 > Framed-IP-Address=1.1.1.1 > Acct-Session-ID=500A02B2382F3D8E > rad_recv: Disconnect-ACK packet from host 1.1.1.1 port 3799, id= 214, > length=20 > > Sending Disconnect-Request of id 215 to 2.2.2.2 port 3799 > Framed-IP-Address=2.2.2.2 > Acct-Session-ID=500A02B5383F27D9 > rad_recv: Disconnect-ACK packet from host 2.2.2.2 port 3799, id=215, > length=20 > > I need to know if It's possible to do this (I think by using a loop > "for"!!!)? Can you please help me? > > Thanks for your help. > > Best regards, > > Ulrich RAMASSAMY > T?l: +33671783501 > > PS: Sorry for my english^^ >

2 1

Re: Freeradius-Users Digest, Vol 85, Issue 14 - Use Case Radclient (correction)
by ulrich ramassamy 07 May '12

07 May '12

Hello everybody, I have one problem with an options of raclient tool's: I have create a little script: (I have one file named "file1") and in this file, I have 3 columns (IP, MSISDN,Acct-Session-Id): IP MSISDN Acct-Session-Id 1.1.1.1 3368894XXXX 500A02B2382F3D8E 2.2.2.2 3368739XXXX 500A02B5383F27D9 ###### BEGIN ###### old_IFS=$IFS IFS=$'\n' for i in `cat file1` do echo $i | gawk '{print "Acct-Session-Id="$3"\n""NAS-IP-Address="$1}' | radclient -p 100 -x 3.3.3.3:3799 disconnect ''secret'' done IFS=$old_IFS ###### END ###### But in this script the parameter -p is not used!!!! root@ulrich-Pod1:/etc/freeradius# old_IFS=$IFS root@ulrich-Pod1:/etc/freeradius# IFS=$'\n' root@ulrich-Pod1:/etc/freeradius# root@ulrich-Pod1:/etc/freeradius# for i in `cat file1` > do echo $i | gawk '{print "Acct-Session-Id="$3"\n""NAS-IP-Address="$1}' | radclient -p 100 -x 3.3.3.3:3799 disconnect ''secret'' > done Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 radclient: no response from server for ID 127 socket 3 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 radclient: no response from server for ID 206 socket 3 root@ulrich-Pod1:/etc/freeradius# root@ulrich-Pod1:/etc/freeradius# IFS=$old_IFS The problem "radclient: no response from server" it's normal because it's just a test and the "disconnect server" it's not configure!! But the problem is that I specify in the script that we can send up to 100 requests in parallel but I see that the script sends only one request at a time, and if there is no answer two other requests is sent In the man of radclient i have this: -p num_requests_in_parallel Send num_requests_in_parallel, without waiting for a response for each one. By default, radclient sends the first request it has read, waits for the response, and once the response is received, sends the second request in its list. This option allows you to send many requests at simultaneously. Once num_requests_in_parallel are sent, radclient waits for all of the responses to arrive (or for the requests to time out), before sending any more packets. This option permits you to discover the maximum load accepted by a RADIUS server. I thins it's the same problem with option -n! It's a Bug!!!!!!!???? Best Regards Ulrich 2012/5/7 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. radclient (ulrich ramassamy) > 2. Re: multiple ldap servers::solved:: (jeff donovan) > 3. Sync ldap-group with sql profiles (Mohsen Saeedi) > 4. NAS Client (Shawky Skaff) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 6 May 2012 19:46:06 +0200 > From: ulrich ramassamy <ramassamy.ulrich(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: radclient > Message-ID: > <CAKYkJTp9Fi6kZAwSptUBZZXCq3To1B6jSrkTWvw5SRP=ZW_STw(a)mail.gmail.com > > > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > > I am writing you because I need your help on using the tool "radclient". > I need to send Packet Of Disconnect (POD). I have one file (for example > name "file1") and in this file, I have 3 columns (IP, MSISDN, > Acct-Session-Id): > > IP MSISDN Acct-Session-Id > 1.1.1.1 3368894XXXX 500A02B2382F3D8E > 2.2.2.2 3368739XXXX 500A02B5383F27D9 > > I read on this site: "http://wiki.freeradius.org/Disconnect-Messages" and > the proposed solution tells us to insert in a file "packet.txt" the > attributes that we wish send. In this method we have to create one file for > one POD. :( > > Now I want to use the file "file1" by selecting the attibutes to send POD > one to one in one command (linux command) like this : > > Sending Disconnect-Request of id 214 to 1.1.1.1 port 3799 > Framed-IP-Address=1.1.1.1 > Acct-Session-ID=500A02B2382F3D8E > rad_recv: Disconnect-ACK packet from host 1.1.1.1 port 3799, id= 214, > length=20 > > Sending Disconnect-Request of id 215 to 2.2.2.2 port 3799 > Framed-IP-Address=2.2.2.2 > Acct-Session-ID=500A02B5383F27D9 > rad_recv: Disconnect-ACK packet from host 2.2.2.2 port 3799, id=215, > length=20 > > I need to know if It's possible to do this (I think by using a loop > "for"!!!)? Can you please help me? > > Thanks for your help. > > Best regards, > > Ulrich RAMASSAMY > T?l: +33671783501 > > PS: Sorry for my english^^ >

1 0