- Freeradius-Users - lists.freeradius.org

port 1813
by Selcuk Yazar 19 Dec '11

19 Dec '11

Hi, we have FreeRADIUS Version 2.1.12 on freebsd, in proxy.conf we have settings ; home_server localhost { type = auth+acct port = 1812 ... } but when i looked up with netstat- n freeradius doen't listen port 1813 . what is the problem ? thanks in advance. -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

2 1

Re: Referencing LDAP attributes in post-auth
by Adam Track 19 Dec '11

19 Dec '11

>Full debug please. > >Broadly speaking the approach you're trying should work. Most likely >there's some subtlety which the partial debug doesn't show. > >One obvious question: you have defined "Person-Type" in a dictionary >somewhere, haven't you? e.g. in raddb/dictionary: > >ATTRIBUTEPerson-Type3099string > >Also, the usual "upgrade 2.1.8 is a bit old" note goes here ;o) I recently saw another question along the same lines as this, so decided to give this another go... Am now running 2.1.10, and yes, Person-Type is defined in dictionary and ldap.attrmap. I've also defined in dictionary the following in hopes of passing on the value of Person-Type to this attribute: ATTRIBUTE Person-Group 3001 string For the (outer) virtual server, in the authorize block I have the following: ... ldap update control { Person-Group = "%{reply:Person-Type}" } ... In post-auth: ... update reply { Reply-Message := "You are %{control:Person-Group}." } ... I still cannot figure out how to pass this value from authorize to post-auth. BTW, this is a multi-valued attribute, so what I'm really trying to do is to call a perl script in post-auth to iterate through all possible values, and set vlan based on whether a particular value exists, thus shouldn't be done within authroize. Debug attached (I hope).. can't seem to post with it on here due to 100KB limit. A.

3 8

RV: Reading winbind reply failed!
by Erick Rojas Bastidas 19 Dec '11

19 Dec '11

Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Mon, 19 Dec 2011 18:26:06 To: <freeradius-users(a)lists.freeradius.org> Reply-To: erickj_rojasb(a)hotmail.com Subject: RV: Reading winbind reply failed! ------Mensaje original------ Para: freeradius-users(a)lists.freeradius.org Asunto: RV: Reading winbind reply failed! Enviado: 16 de dic, 2011 11:53 AM ------Mensaje original------ Para: freeradius-users(a)lists.freeradius.org Asunto: Reading winbind reply failed! Enviado: 16 de dic, 2011 10:15 AM I have configured freeradius 2.1.10 with eap-tls and certificates openssl, mschap response is incorrect why? I don't know what the problem with winbind.. HELP ME PLEASE! Thanks.. [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel[mschapv2] +- entering group MS-CHAP {...}[mschap] Creating challenge hash with username: USER[mschap] Told to do MS-CHAPv2 for USER with NT-Password[mschap] expand: --username=%{mschap:User-Name:-None} -> --username=USER[mschap] expand: %{mschap:NT-Domain} -> DOMAIN[mschap] expand: --domain=%{%{mschap:NT-Domain}:-DOMAIN} -> --domain=DOMAIN[mschap] mschap2: 38[mschap] Creating challenge hash with username: USER[mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=8e5d0057de5cde20[mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=ad08d60b1e6160fb877d4e678622dfc732af9bcc883716a8Exec-Program output: Reading winbind reply failed! (0xc0000001)Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001)Exec-Program: returned: 1[mschap] External script failed.[mschap] FAILED: MS-CHAP2-Response is incorrect Enviado desde mi dispositivo movil BlackBerry® de Digitel.

1 0

Re: port 1813 (Selcuk Yazar)
by Rui Ribeiro 19 Dec '11

19 Dec '11

> > 1. port 1813 (Selcuk Yazar) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 19 Dec 2011 12:06:08 +0200 > From: Selcuk Yazar <selcuk.yazar(a)gmail.com> > Subject: port 1813 > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <CACBG-R1Kev96uOmjs-f0sOo=D6noMjMYeHoKKrgB=axBNCN3jg(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > > we have FreeRADIUS Version 2.1.12 on freebsd, > > in proxy.conf we have settings ; > > home_server localhost { > > type = auth+acct > port = 1812 > ... > > } > > but when i looked up with netstat- n freeradius doen't listen port 1813 . > > what is the problem ? > > thanks in advance. > > HI Selcuk, I remember the freeradius docs and sample file stating that you should use port = 0, so the appropriate ports are picked up from /etc/services; another alternative syntax I am using to define my proxy is realm DEFAULT { type = radius authhost = proxy1.xxxx:1812 accthost = proxy1.xxxx:1813 secret = xxxxxxxx nostrip } cheers, Rui

3 2

radrelay: cross-replication of accounting records between two redundant freeradius servers
by Arch Mangle 18 Dec '11

18 Dec '11

Hi List I've got radrelay replicating accounting packets from a primary radius server to a secondary radius server. The secondary radius server is capable of handling radius accounting/auth requests if NASes cannot reach the primary or the primary fails. I want to replicate packets from the secondary to the primary server in addition to replicating from primary to secondary, and so I tried setting up radrelay on the secondary identically to the one on the primary. The idea is to use radrelay as a simple mechanism to ensure that both servers have a copy of all the accounting packets. However, when I test sending accounting packets to the secondary, the two systems go into some kind of circular loop, neither being smart enough to recognise a replicated auth packet when it sees one :-) When I look at the incoming packet dumps I see accounting requests being replicated and responded to with ever-increasing numbers of Proxy-State attributes, until the radrelay instance crashes with a thread related error: --- Sending Accounting-Request of id 76 to 10.1.1.112 port 1646 User-Name = "morpork(a)ankh.morpork.org" Service-Type = Framed-User NAS-IP-Address = 196.7.321.6 NAS-Identifier = "196.7.321.6" NAS-Port = 1234 NAS-Port-Type = Async Acct-Session-Id = "00001234" Acct-Status-Type = Stop Called-Station-Id = "123456789" Calling-Station-Id = "987654321" Acct-Delay-Time = 5108 Acct-Session-Time = 1000 Acct-Input-Octets = 20000 Acct-Output-Octets = 30000 Proxy-State = 0x3231353235 Proxy-State = 0x3236333439 Proxy-State = 0x3135343437 Proxy-State = 0x3136313331 Proxy-State = 0x35383236 Proxy-State = 0x3435313436 Proxy-State = 0x3532303932 Proxy-State = 0x3137323331 Proxy-State = 0x39323331 Proxy-State = 0x3239343737 Proxy-State = 0x3435383237 Proxy-State = 0x3138313734 Proxy-State = 0x3239343138 Proxy-State = 0x373430 Proxy-State = 0x393131 . . --- My question is, how would i configure two-way replication in a scenario like this, without the loops ? Informational: Server 1/Primary : FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, (Debian squeeze/sid) Server 2/Secondary : FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu (CentOS 5.5) (both systems on the same physical network and subnet) Thanks in advance, Arch

2 2

Re: FreeRadius going through ISA to reach federation
by Rui Ribeiro 18 Dec '11

18 Dec '11

> > Message: 5 > Date: Sat, 17 Dec 2011 10:51:42 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: FreeRadius going through ISA to reach federation > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4EEC743E.5000606(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 12/16/2011 09:20 PM, Rui Ribeiro wrote: > >>> Eh? Who suggested that? >> Another freeradius<->IAS thread in this list. > > Well, it's not a very useful suggestion in this instance. Setting > Reply-Message won't magically make something work. Perhaps the original > thread had some context that explains why the person thought it was > useful at that juncture. > Indeed. I have taken it away. >>> >>> That's not an error; it's just a radius attribute. >>> >> In the debug logs, I have: >> ad_recv: Access-Reject packet from host 10.10.66.18 port 1812, id=251, >> length=24 >> Proxy-State = 0x3137 >> > > Yes, I know. What I'm trying to tell you is that "Proxy-State" is just a > radius attribute related to proxying. It would be present in any packet, > accept, challenge or reject, from the upstream server. > Indeed, I understood it after getting it to work. > Ignore the Proxy-State. What matters is that the "code" is > Access-Reject. The upstream server either rejected the packet itself, or > forwarded a reject from the wider eduroam proxy hierarchy. > >> >>>> >>>> Any advice? >>> >>> You will need to debug this on the IAS server, since it is sending (or >>> proxying) the reject. My guess is the policies in IAS are wrong. >>> They needed indeed to be modified. I thought a policy I defined was enough, but the default wizard policies didn't work, had to create a custom policy by hand, and create a new attribute allowing the roaming. It is working fairly well now; so I thanks everyone that suggested me to look better at IAS, and particularly to you Phil, for the nice offer of help off the list. Since authentication to normal users and roaming to federation was solved, I am already tagging VLANs according to if people are teachers, students or roaming, but will have to test it better in an AP Monday. Best regards, Rui Ribeiro

1 0

Re: Always Login incorrect: Could not extract EAP-Message from RADIUS message
by Sergio Belkin 17 Dec '11

17 Dec '11

2011/12/16 Sergio Belkin <sebelk(a)gmail.com>: > Hi, > > I have a really weird problem. We have a lot of NAS'es and no one of > them had this problem. It gets always login incorrect. If I run > eapol_test it complains saying. I've tried replacing the nas a few > times and makes no difference. And it doesnt' matter what user tries > to connect. > > > could not extract EAP-Message from RADIUS message > EAPOL: EAP key not available > > This the debug output of freeradius. Please could you help me to solve > this issue? Problem happens with client "192.168.3.201" Sorry, but not pay attention to ipaddress, (File has edited the sensitive data). Pleease take a look to user "interup" with outer identity "SOYKADORNA" Thanks again -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

2 7

Re: FreeRadius going through ISA to reach federation
by Rui Ribeiro 17 Dec '11

17 Dec '11

> > Date: Fri, 16 Dec 2011 16:39:07 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: FreeRadius going through ISA to reach federation > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4EEB742B.50302(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 16/12/11 14:29, Rui Ribeiro wrote: >> Hi all, >> >> I have configuring a FreeRadius, and I need to go through a IAS to reach the > > Ugh. Nasty. IAS as an eduroam proxy! Actually is just for testing, will talk with the responsible entity next week, but with the festivities at the door, roaming through IAS would probably allow me to switch to freeradius sooner. > >> eduroam federation. I created a realm for our local domain, created a >> DEFAULT proxy for users with other domains pointing to the IAS server, both >> are as clients of each other, share the same secret, and also defined a >> Remote access policy in IAS. >> >> Tried already some alternatives, and inserted Reply-Message = "Yes", as >> suggested on another post in the list. > > Eh? Who suggested that? Another freeradius<->IAS thread in this list. > >> >> Despite all the efforts, when talking with the IAS, I receive back the error >> Proxy-State = 0x3137. > > That's not an error; it's just a radius attribute. > In the debug logs, I have: ad_recv: Access-Reject packet from host 10.10.66.18 port 1812, id=251, length=24 Proxy-State = 0x3137 >> >> Any advice? > > You will need to debug this on the IAS server, since it is sending (or > proxying) the reject. My guess is the policies in IAS are wrong. > > Tried to see the IAS logs, they didn't much sense. Will have a look at system events. > ------------------------------ >

3 2

FreeRADIUS 2.1.12 rlm_sqlcounter bug‏
by ben beneke 17 Dec '11

17 Dec '11

Hi, I am using FreeRADIUS Version 2.1.12, for host i686-pc-linux-gnu, built on Dec 6 2011 at 19:51:34, and I'd like to set up a quota using rlm_sqlcounter. However, the quota I'd like to use is over 4GB and the module will than overflow, not allowing a user who still has quota left. The user with the attributes: mysql> select * from radcheck; +----+----------+--------------------+----+-------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+-------------+ | 18 | test1 | Max-Octets | := | 29687864955 | | 15 | test1 | Cleartext-Password | := | test | +----+----------+--------------------+----+-------------+ sqlcounter.conf: sqlcounter volumelimitcounter { counter-name = Total-Max-Octets check-name = Max-Octets reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = never error-msg = "Sorry, your bandwidth has exceeded the provided limit" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct where UserName='%{${key}}'" } radiusd output: [volumelimitcounter] expand: %{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct where UserName='test1'} -> 25687864955 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user test1, check_item=4294967295, counter=4294967295 ++[volumelimitcounter] returns reject full debug log: can be found at http://pastebin.com/fs2ed6pF Any feedback would be greatly appreciated. Kind regards, Ben

6 9

FreeRadius radrelay and proxying the Realm attribute to the home_server
by Arch Mangle 16 Dec '11

16 Dec '11

Hi List I have a working radrelay configuration running on FreeRADIUS Version 2.1.10 for debian linux (squeeze/sid). It successfully duplicates radius accounting packets from the detail file to the remote server. However, I see that the "Realm" Attribute, while logged in the detail file of the local system, is not written to the radrelay detail file and proxied to my remote server. For easing my particular process of radius accounting/billing, I'd like to have this attribute written to the radrelay detail file in addition to that of the local server. How would I accomplish this ? Here's what a typical accounting packet looks like on my local server's detail file (the proxy-ing server): --- Fri Dec 16 13:16:00 2011 User-Name = "morpork(a)ankh.morpork.org" Service-Type = Framed-User NAS-IP-Address = 199.55.541.8 NAS-Identifier = "199.55.541.8" NAS-Port = 1234 NAS-Port-Type = Async Acct-Session-Id = "00001234" Acct-Status-Type = Start Called-Station-Id = "123456789" Calling-Station-Id = "987654321" Acct-Delay-Time = 0 Acct-Unique-Session-Id = "ee50b494e1ff4c15" Realm = "ankh.morpork.org" Timestamp = 1324034160 Request-Authenticator = Verified --- And here's how it typically shows up on my remote_home server's detail file after being radrelay'ed: --- Fri Dec 16 13:15:59 2011 User-Name = "morpork(a)ankh.morpork.org" Service-Type = Framed-User NAS-IP-Address = 199.55.541.8 NAS-Identifier = "199.55.541.8" NAS-Port = 1234 NAS-Port-Type = Async Acct-Session-Id = "00001234" Acct-Status-Type = Start Called-Station-Id = "123456789" Calling-Station-Id = "987654321" Acct-Delay-Time = 0 Proxy-State = 0x3435323833 Acct-Unique-Session-Id = "a1affd962a445d0c" Timestamp = 1324034159 Request-Authenticator = Verified --- I'd like to write (or otherwise shoehorn :P ) in the "Realm" attribute to the radrelay detail file. What would be the simplest way to do this? Note that my server handles multiple realms. Many thanks in advance, Arch Mangle

2 2