- Freeradius-Users - lists.freeradius.org

TEST
by Коньков Евгений 04 Dec '11

04 Dec '11

some problem with this mail list, trying to test sorry

1 0

freeradius, problem with chap ?
by Piotr 04 Dec '11

04 Dec '11

Hello I have two kind of remote access on cisco asa, first ovia ssl vpn and second via l2tp/ipsec (for mobile phones with androids). Both access are made on the same cisco and both autorizen on the same freeradius server with motp ( mobile one time password). Access via ssl vpn works correct but access via l2tp/ipsec not. I see that there is some problem with auth. For l2tp/ipsec i set authorization chap ( i disabled mschap v1 and v2, they didn't work also) Thank You for any help This is debug from l2tp/ipsec connection: rad_recv: Access-Request packet from host 10.162.1.1 port 1025, id=240, length=134 User-Name = "tom3" CHAP-Password = 0x01972f0886c4e5e2f30e32053dbcf67504 NAS-Port = 5357568 Service-Type = Framed-User Framed-Protocol = PPP CHAP-Challenge = 0x119f01e96a9a794879f770373a39827c7463bb1cfd4c9bf6ebeac4fb1ac47b3b8b1861bee84b0273d5 Tunnel-Client-Endpoint:0 = "83.6.6.66" NAS-IP-Address = 10.162.1.1 NAS-Port-Type = Virtual +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok [suffix] No '@' in User-Name = "tom3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry DEFAULT at line 2 [files] expand: /usr/local/bin/otp4freeradius.sh '%{User-Name}' '%{User-Password}' '%{reply:Secret}' '%{reply:Pin}' '%{reply:Offset}' -> /usr/local/bin/otp4freeradius.sh 'tom3' '' '' '' '' [files] users: Matched entry tom3 at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "tom3" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Login incorrect (rlm_chap: Clear text password not available): [tom3/<CHAP-Password>] (from client ciscoasa port 5357568) /raddb/users: DEFAULT Auth-Type = External Exec-Program-Wait = "/usr/local/bin/otp4freeradius.sh '%{User-Name}' '%{User-Password}' '%{reply:Secret}' '%{reply:Pin}' '%{reply:Offset}'", Fall-Through = Yes tom3 Secret = f11111xxxx1111a, PIN = yyyy, Offset = 0, CVPN3000-IETF-Radius-Class := "press" cat radiusd.conf ... modules { exec MOTP { wait = yes program = "/usr/local/bin/otp4freeradius.sh %{User-Name} %{User-Password} %{reply:Secret} %{reply:Pin} %{reply:Offset}" input_pairs = request output_pairs = reply } $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ cat raddb/sites-enabled/default authorize { preprocess chap mschap suffix files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type External { MOTP } unix } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp attr_filter.accounting_response } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { } and here is debug from working connection for sslvpn: rad_recv: Access-Request packet from host 10.162.1.1 port 1025, id=239, length=136 User-Name = "tom3" User-Password = "bd8d9a" NAS-Port = 5353472 Called-Station-Id = "7.24.64.182" Calling-Station-Id = "9.72.8.13" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "9.72.8.13" NAS-IP-Address = 10.162.1.1 Cisco-AVPair = "ip:source-ip=9.72.8.13" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "tom3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry DEFAULT at line 2 [files] expand: /usr/local/bin/otp4freeradius.sh '%{User-Name}' '%{User-Password}' '%{reply:Secret}' '%{reply:Pin}' '%{reply:Offset}' -> /usr/local/bin/otp4freeradius.sh 'tom3' 'bd8d9a' '' '' '' [files] users: Matched entry tom3 at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = External +- entering group External {...} [MOTP] expand: %{User-Name} -> tom3 [MOTP] expand: %{User-Password} -> bd8d9a [MOTP] expand: %{reply:Secret} -> f11111111xx111a [MOTP] expand: %{reply:Pin} -> xyzw [MOTP] expand: %{reply:Offset} -> 0 Exec-Program output: ACCEPT czas:2011-12-01 21:27:32 Exec-Program-Wait: plaintext: ACCEPT czas:2011-12-01 21:27:32 Exec-Program: returned: 0 ++[MOTP] returns ok Login OK: [tom3/bd8d9a] (from client ciscoasa port 5353472 cli 9.72.8.13) WARNING: Empty section. Using default return values. Sending Access-Accept of id 239 to 10.162.1.1 port 1025 CVPN3000-IETF-Radius-Class := "press" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 239 with timestamp +308 Ready to process requests.

4 4

Radacct update at 3 hours
by Hitesh Vinzoda 04 Dec '11

04 Dec '11

Hi, We want to have accounting records created every 3 hours in case the users are not disconnected to create daily/weekly/monthly report. I have gone through all the steps involved till modifying the accounting queries in sql.conf, i realized that my sql.conf is different from one listed at http://freeradius.org/radiusd/raddb/sql.conf Now i stalled that whether to modify. I am using FR 2.1.10. LNS is setup to send periodic updates every 3 hours and FR is updating the records but the acctstarttime is unchanged and acctstoptime is set to "null" but i can see that the acctinoctets and output octets are updated. We need to have separate record created in MYSQL radacct table once received update from the LNS. Any help on this would be appreciated. Thanks in advance Hitesh Vinzoda Network Administrator +91-9924117399 www.vinzoda.in "There are 10 types of people in this world. One who can understand binary and other's can't."

4 7

Change of network adapters in radius server
by Roland Pinches 02 Dec '11

02 Dec '11

Hi, We've run into a problem with our freeradius server virtual machine. It's a RHEL5.5 VM running on ESXi 4.1 and it talks to a cisco NAS. It currently works but we have performance issues, which I have partly tracked down to a very specific VMware issue - if running linux with more than 1 vCPU, vmxnet3 NIC connected to a distributed vSwitch. The work around is to change the network adapters to something other than a vmxnet3 adapter. However, this is where my radius problem comes in. When I change the NICs, the MAC address changes, which means I need to setup the static IP addresses again. Not a problem and I can then ping the cisco device and the cisco device can ping the radius server. The problem is, no radius traffic flows between them. Since this is a VM, I took a snapshot first, so rolling back to the snapshot started radius working again with the vmxnet3 adapter and the old MAC address. iptables is disabled so there are no firewall issues. The arp table on the cisco device has had the old MAC address entry for the radius server removed and it detects the new MAC address correctly after a ping. Is there something I have missed that binds radius to a specific MAC address? The MAC address change is the only thing I can think of, but may have nothing to do with it. Running radtest on the radius server would appear to show that radius is authenticating successfully and the radius.log shows radius started and ready to accept connections. Can anyone offer suggestions? I can provide the output from radiusd -X if needed but will take me a day or two to get it since this is on a production server that can only be worked on at 3am! The VM is configured with 2 vCPU and 4GB RAM. The cisco NAS is reporting approx 2000 requests a minute, so not exactly super busy. I've seen other posts in the mailing list suggesting FreeRADIUS can cope with 1000's per second! Many thanks, Roly.

5 6

Re[4]: configuration freeradius for no simultaneous use
by Толик Шавловский 02 Dec '11

02 Dec '11

Dear Alan, i am not good acquainted with freeradius. So, from doc/Simultaneous-use i understood that freeradius requres script, which will connect to NAS and check user session. Am i right? 02 декабря 2011, 12:43 от "Fajar A. Nugraha" <list(a)fajar.net>: > On Fri, Dec 2, 2011 at 3:37 PM, tolik_shavlovsky(a)mail.ru > <tolik_shavlovsky(a)mail.ru> wrote: > > Dear Alan, > > > > i added Simultaneous-Use = 1 to user profile in users file. > > Did you read the doc? Or the reply I sent earlier? > > It requires MORE than just that. > > -- > FAN > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

4 5

Daily accounting
by David Roze 02 Dec '11

02 Dec '11

Hi everyone, I have seen a lot of people who are trying to get traffic accounting collected at regular intervals to generate graphs and view per day/month etc... I have made a few modifications in order to achieve this. You can see it at http://www.netexpertise.eu/en/FreeRadius/DailyAcct.html It works on Mysql setup but can be adapted to any db. I'd be grateful to get some feedback on this. A lot of ISPs are running into this problem. Hope this helps Regards, David

2 1

AK Timeout
by David Peterson 02 Dec '11

02 Dec '11

In one of my NAS release notes it mentions: "In the external AAA, the re-authentication timer (AK Life time) should be set to a value higher than 1hour." Where would I set this? David

4 4

Minor change to the WIki
by Alan DeKok 02 Dec '11

02 Dec '11

We've removed Facebook authentication from the Wiki. About 50% of the edits to the wiki are nonsense. People creating empty pages, or pages with text of "how do I do...", or pages with "sxwdxx" The hope is that removing facebook means that those kind of edits will go away. Alan DeKok.

1 0

configuration freeradius for no simultaneous use
by tolik_shavlovsky＠mail.ru 02 Dec '11

02 Dec '11

Hi, i need your help in configuration freeradius for no simultaneous use. So, i need one active user per login/password. I configured user as follow: test1(a)wimax.com Cleartext-Password := "test" Framed-Filter-Id = "SP=data:MSF=data;", Simultaneous-Use = 1, but my WIMAX CPEs (also WiFi users) continue connecting with the same login/password. what can be the issue? thanks Anatolii -- View this message in context: http://freeradius.1045715.n5.nabble.com/configuration-freeradius-for-no-sim… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

annoying stop retransmissions.
by Alexandre Chapellon 01 Dec '11

01 Dec '11

Hello, I have a setup wich Is a follow: NASes ----------------FREERADIUS Auth+live acct ----------------FREERADIUS Acct only In this setup, users connect to NASes, which authenticate them against the front freeradius (Auth + live acct). The front freeradius, maintain a db of the connected users using acct tickets. Basicly it does: INSERT in table upon Start ticket reception DELETE from table upon Stop ticket reception. In turns the front freeradius proxies acct tickets to the back freeradius (Acct only), which keeps track of all sessions doing: INSERT in table upon Start ticket reception UPDATE table upon Stop ticket reception. This work as epected for most of my NASes. Unfortunately, i have some NASes that are behind a satelite link, which is a very unreliable link with regular packets loss. UDP retramission of packet make the systems work even with that kind of link, but I have one scenario that create errors: When a stop ticket is transmitted once and reaches correctly the freradius servers (nas -> front -> back), Session record is deleted from the "live acct" table, packet is then proxied to the 2nd freeradius and session in Acct table is marked as stoped (acctstoptime=something). If the front freeradius acks the Stop packet and that Ack is lost on the link, the NAS retransmit the STOP. Same thing occur,: - front radius tries to delete the sessions using its acct_stop_query, wich result in no line being modified and so tries to run its acct_stop_query_alt (which basicly does the same thind: delete). alt query also modify no lines but no error is logged. retransmitted packet is then proxied to the back server, wich in turns tries ti run its acct_stop_query (tries to update a session with no acctstoptime). That query fails as the previous Stop ticket for that session already updated the recod. It then tries to run the acct_stop_query_alt, which is designed to try to insert a new session record based on the content of the stop ticket (this is done to deal with the case where start ticket is lost and only stop ticket is received, i guess). In my case this last query fails because of some unicity constraint in the oracle database (to prevent one session from being recorded multiple times), and an error is logged in freeradius. I can't really afford to get rid of the unique constraint, and I think changing the acct_stop_query_alt for a non insert statement would not be a good idea either. Does anybody have an idea on how to deal with that (minor) problem so I have no more regular error messages. I was maybe thinking of not proxying to the back server, packets retransmitted du to ACK loss, but I can't really find out how to do that... Thanks for reading that long post (I hope it's understandable enough). -- <http://www.horoa.net> Alexandre Chapellon Ingénierie des systèmes open sources et réseaux. Follow me on twitter: @alxgomz <http://www.twitter.com/alxgomz>

4 9