- Freeradius-Users - lists.freeradius.org

References for New RADIUS Names/Old RADIUS Names
by Det Det 08 Sep '11

08 Sep '11

Hi, Any idea where I can see list of new names for those RADIUS attributes/values that's been obsoleted. Just want to confirm, for example, Framed-Filter-Id is obsolete, is Filter-Id a replacement to that? thanks! det

2 3

Specifying Any Port for RADIUS Client
by Det Det 08 Sep '11

08 Sep '11

Hi, I want to connect to RADIUS server using RADIUS client software, not through NAS. Using RADIUS client software such as radperf will generate different port numbers when connecting to the RADIUS server. How do I place client information in NAS table such that I am able to specify IP and "any ports". When client connects to RADIUS server, server will just respond with, Ignoring request to authentication address * port 1812 from unknown client 192.168.0.10 port 52268 thanks! det

2 3

Re: rad_verify: Received Disconnect-ACK packet from home server with invalid signature! (Shared secret is incorrect.) for CoA, and PoD
by Alan DeKok 07 Sep '11

07 Sep '11

Martin wrote: > I forgot about radius -X. <sigh> If you're going to make it hard to help you, I'm just going to delete your posts. The debug output you posted is *useless*. You claimed it had problems when receiving packets. So to "help", you post a debug output... where it doesn't receive packets. > regarding the other AAA I don't have access to it. Then how do you know it works? Alan DeKok.

2 4

RADIUS Disconnect request support in free radius client -1.1.6
by vikraman.p36＠wipro.com 07 Sep '11

07 Sep '11

Hi , I am looking into Free radius client (freeradius-client-1.1.6) library code for using in our project. Please let me know if the Free radius client supports processing of the disconnect request message from RADIUS server which is defined in the RFC 5176. Thanks, Vikraman Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

rad_verify: Received Disconnect-ACK packet from home server with invalid signature! (Shared secret is incorrect.) for CoA, and PoD
by Martin 07 Sep '11

07 Sep '11

Hi, I am trying CoA and DM with Alvarion ASN-GW and all the time I see Shared secret is incorrect for the AcK/NaK messagess received from the ASN. With other AAA, based also on FR, it is not happeing. No. Time Source Destination Protocol Info 1 0.000000 192.168.60.28 192.168.60.122 RADIUS Disconnect-Request(40) (id=28, l=126) Frame 1: 168 bytes on wire (1344 bits), 168 bytes captured (1344 bits) Arrival Time: Sep 7, 2011 11:56:04.799904000 E. Europe Daylight Time Epoch Time: 1315385764.799904000 seconds [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 168 bytes (1344 bits) Capture Length: 168 bytes (1344 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:radius] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef), Dst: Cisco_82:0b:0c (00:23:33:82:0b:0c) Destination: Cisco_82:0b:0c (00:23:33:82:0b:0c) Address: Cisco_82:0b:0c (00:23:33:82:0b:0c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) Address: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.60.28 (192.168.60.28), Dst: 192.168.60.122 (192.168.60.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 154 Identification: 0xe708 (59144) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0x9963 [correct] [Good: True] [Bad: False] Source: 192.168.60.28 (192.168.60.28) Destination: 192.168.60.122 (192.168.60.122) User Datagram Protocol, Src Port: 44512 (44512), Dst Port: radius-dynauth (3799) Source port: 44512 (44512) Destination port: radius-dynauth (3799) Length: 134 Checksum: 0x46c1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Radius Protocol Code: Disconnect-Request (40) Packet identifier: 0x1c (28) Length: 126 Authenticator: d87a22f8d9e48cb34e67b846c34f78c7 [The response to this request is in frame 2] Attribute Value Pairs AVP: l=46 t=User-Name(1): 6323AFDFB8A0E5AAB2582D5F39DF038D(a)alvarion.ro User-Name: 6323AFDFB8A0E5AAB2582D5F39DF038D(a)alvarion.ro AVP: l=41 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=35 t=WiMAX-AAA-Session-Id(4) C=0x00: 313865643938336633633233373163366634626336393265... WiMAX-AAA-Session-Id: 313865643938336633633233373163366634626336393265... AVP: l=19 t=Calling-Station-Id(31): 00-17-c4-3d-41-ea Calling-Station-Id: 00-17-c4-3d-41-ea 0000 00 23 33 82 0b 0c 00 1b 21 3d 2f ef 08 00 45 00 .#3.....!=/...E. 0010 00 9a e7 08 00 00 40 11 99 63 c0 a8 3c 1c c0 a8 ......@..c..<... 0020 3c 7a ad e0 0e d7 00 86 46 c1 28 1c 00 7e d8 7a <z......F.(..~.z 0030 22 f8 d9 e4 8c b3 4e 67 b8 46 c3 4f 78 c7 01 2e ".....Ng.F.Ox... 0040 36 33 32 33 41 46 44 46 42 38 41 30 45 35 41 41 6323AFDFB8A0E5AA 0050 42 32 35 38 32 44 35 46 33 39 44 46 30 33 38 44 B2582D5F39DF038D 0060 40 61 6c 76 61 72 69 6f 6e 2e 72 6f 1a 29 00 00 @alvarion.ro.).. 0070 60 b5 04 23 00 31 38 65 64 39 38 33 66 33 63 32 `..#.18ed983f3c2 0080 33 37 31 63 36 66 34 62 63 36 39 32 65 30 63 38 371c6f4bc692e0c8 0090 39 64 66 66 65 1f 13 30 30 2d 31 37 2d 63 34 2d 9dffe..00-17-c4- 00a0 33 64 2d 34 31 2d 65 61 3d-41-ea No. Time Source Destination Protocol Info 2 0.006588 192.168.60.122 192.168.60.28 RADIUS Disconnect-ACK(41) (id=28, l=20) Frame 2: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) Arrival Time: Sep 7, 2011 11:56:04.806492000 E. Europe Daylight Time Epoch Time: 1315385764.806492000 seconds [Time delta from previous captured frame: 0.006588000 seconds] [Time delta from previous displayed frame: 0.006588000 seconds] [Time since reference or first frame: 0.006588000 seconds] Frame Number: 2 Frame Length: 62 bytes (496 bits) Capture Length: 62 bytes (496 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:radius] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_82:0b:0c (00:23:33:82:0b:0c), Dst: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) Destination: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) Address: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_82:0b:0c (00:23:33:82:0b:0c) Address: Cisco_82:0b:0c (00:23:33:82:0b:0c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.60.122 (192.168.60.122), Dst: 192.168.60.28 (192.168.60.28) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0x0034 (52) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 63 Protocol: UDP (17) Header checksum: 0x41a2 [correct] [Good: True] [Bad: False] Source: 192.168.60.122 (192.168.60.122) Destination: 192.168.60.28 (192.168.60.28) User Datagram Protocol, Src Port: radius-dynauth (3799), Dst Port: 44512 (44512) Source port: radius-dynauth (3799) Destination port: 44512 (44512) Length: 28 Checksum: 0x9131 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Radius Protocol Code: Disconnect-ACK (41) Packet identifier: 0x1c (28) Length: 20 Authenticator: e175db63a6510f8f0e0319352deac6d8 [This is a response to a request in frame 1] [Time from request: 0.006588000 seconds] 0000 00 1b 21 3d 2f ef 00 23 33 82 0b 0c 08 00 45 00 ..!=/..#3.....E. 0010 00 30 00 34 40 00 3f 11 41 a2 c0 a8 3c 7a c0 a8 .0.4@.?.A...<z.. 0020 3c 1c 0e d7 ad e0 00 1c 91 31 29 1c 00 14 e1 75 <........1)....u 0030 db 63 a6 51 0f 8f 0e 03 19 35 2d ea c6 d8 .c.Q.....5-... Martin Ion

2 1

CoA proxying again
by Bjørn Mork 07 Sep '11

07 Sep '11

Hello, I am trying to setup CoA proxying to a number of Juniper MXes. These are a bit clumsy to configure as CoA servers: The CoA clients cannot be configured explicitly. Instead they reuse the auth/acct configuration, including secret, for CoA clients. So I have a few hundred CoA servers (NASes), and 3 radius servers authorized as CoA clients. Using FreeRADIUS to proxy CoA requests from ther real CoA clients looks like a perfect solution. My problem is that the configuration seems a bit clumsy, given that I cannot really change neither IP address nor secret from what's already there in the FreeRADIUS client definition. It would have been ideal to just add a flag or whatever, saying that "this client is also a CoA server", and allowing direct proxy to it using some virtual attribute. My current working configuration requires a separate static home_server and home_server_pool definition pointing to it for *each* NAS, as the only way I've found to redirect the CoA packets is by setting Home-Server-Pool. The documentation talks about Proxy-To-Realm as well, but I've been unable to find any parameter allowing me to configure a realm for CoA. realms only have auth{_pool,host} and acct{_pool,host} AFAICT. The per client CoA configuration doesn't look like anything I can use at all. If I understand it correctly, that's only for the *CoA clients*. Is this a correct view of the current (2.1.x) state of CoA proxying, or did I miss something? I believe I saw a request for dynamic home servers recently. Looks like that might be something for me as well. Bjørn

3 4

SQL IP Pool Control Attribute Placement
by Det Det 07 Sep '11

07 Sep '11

Hi, For the sqlippool, http://wiki.freeradius.org/Rlm_sqlippool, which table should the below control attribute be placed on? It says, it is not a reply attribute, does it then go to radcheck/radgroupcheck table? DEFAULT Pool-Name := main_pool Fall-Through = Yes thanks, det

2 1

Radius Access-Challenge and Apache
by Daniel Abels 07 Sep '11

07 Sep '11

Hi all, I have developed a rlm_perl script for FreeRadius to provide an Access-Challenge response upon an initial successful login (i.e. enter username & password, receive access-challenge, then enter a code.) I'm having some trouble getting the an access-challenge "reply message" to display on a web browser. I'm not sure if I have something configured incorrectly, or If my expectations of what the apache module (mod-auth-radius) should be doing is wrong. According to the documentation from the mod_auth_radius README, when the module receives an "Access-Challenge" response: "...you'll see your username displayed, along with the RADIUS Reply-Message at the top of the authentication window." But I see no such reply-message in the browser. It just displays the same Authentication Realm message ("Radius Authentication Test") for each prompt (tested in Firefox.) I was expecting the reply-message (which is "Please Enter Code") to be displayed instead, is that possible? Upon examining the source code for the module, there appears to be code to handle this. Using Wireshark, it also appears that this message is not returned to the browser. Anyway, if the user enters the correct code at this point, they can reach the web page successfully, so the authentication side of things is not a problem. The server is Debian (squeeze) with freeradius (2.1.10+dfsg-2), apache (2.2.16-6+squeeze1) and libapache2-mod-auth-radius (1.5.8-1) The important portion of my apache configuration is below: # Radius Server Authentication AddRadiusAuth localhost:1812 testing123 5 AddRadiusCookieValid 5 # Test Radius Authentication <Directory /var/www/test/> Options Indexes FollowSymLinks MultiViews AuthType Basic AuthName "Radius Authentication Test" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative On AuthRadiusActive On Require valid-user </Directory> I have performed other tests using a Cisco VPN concentrator and Cisco's VPN client on Windows 7, this works great - the "Access-Challenge" response works (It returns the message "Please Enter Code".) On the command line, this also works using radtest, see below: # radtest user testing localhost 10 testing123 Sending Access-Request of id 150 to 127.0.0.1 port 1812 User-Name = "user" User-Password = "testing" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 rad_recv: Access-Challenge packet from host 127.0.0.1 port 1812, id=150, length=50 Reply-Message = "Please Enter Code" State = 0x6368616c6c656e6765 Any assistance on this matter would be greatly appreciated! Regards, Daniel Abels

2 3

problem with chillispot
by Frank Bonnet 07 Sep '11

07 Sep '11

Hello I'm in trouble using chillispot with freeradius on ubuntu 11.04 server freeradius works well with a LDAP backend but when I start chillispot I get that kind of error messages, the shared secret is OK on both sides as it is a testing install I haven't touch the famous "testing123" Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 56851, id=0, length=162 Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 56851, id=1, length=162 Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Thank you for any idea ...

6 8

Simultaneous Use Per Domain
by Det Det 07 Sep '11

07 Sep '11

Hi, Just want to get inputs on how simultaneous-use can be checked per domain not per user. That is limit mydomain.com to have simultaneous-use=x. radgroupcheck will have something like mydomain.com -- simultaneous-use -- x thanks! det

1 0