- Freeradius-Users - lists.freeradius.org

First-Login
by Rtz Poknat 04 May '11

04 May '11

can u help me how can CAN I DO THIS in freeradius its like i want a certain user to be expired after x minutes since his first login thanks

1 0

Multiple groups per user
by googerdi 03 May '11

03 May '11

Hi I want to have multiple groups per user but radius choose only the highest priority group with lowest number. How can i enable this feature for mysql module if exists! Thanks-- View this message in context: http://freeradius.1045715.n5.nabble.com/Multiple-groups-per-user-tp4362664p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

ldap server connection timeout
by Daniel Davidson 03 May '11

03 May '11

My new wireless network tested great, but now that I have rolled it out to the entire building, I get error messages like: Mon May 2 15:15:06 2011 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. And when these trigger, nearly everyone gets disconnected for about 5 seconds. Possible relevant code from ldap module: ldap { #private stuff ldap_connections_number = 15 timeout = 10 timelimit = 10 net_timeout = 5 } The only existing firewalls are on the machines themselves and the ip range of the servers are open with each other. Any ideas? Dan

3 2

Freeradius, bind addresses, and multihoming
by Gary T. Giesen 03 May '11

03 May '11

I've compiled freeradius with the --with-udpfromto directive. Everything works as expected when I bind to all IPs: listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } However, if I specify multiple IPs to bind to (rather than just one or all), it reverts to the the behaviour of responding to all requests with a source IP of the first bind directive listed. For example: listen { ipaddr = 192.168.1.250 port = 1812 type = auth } listen { ipaddr = 192.168.1.250 port = 1813 type = acct } listen { ipaddr = 1.2.3.4 port = 1812 type = auth } listen { ipaddr = 1.2.3.4 port = 1813 type = acct } In this configuration, freeradius will always respond from 192.168.1.250, even if the initial request was sent to 1.2.3.4. This is obviously breaking things for me, as I'd rather not have freeradius listen on every interface on the server (and there are a number of them). Am I doing something wrong? Am I expecting the wrong behaviour? Or is this a bug? GG

4 6

Re: ldap server connection timeout
by Daniel Davidson 03 May '11

03 May '11

Upon seeing Alan's response, i took the step of installing openldap on the radius machine and then trying it with the ldap module pointing to localhost. I am still seeing the same results from this. The server is up and taking requests. Any other ideas as to what could be causing this? Dan On 05/03/2011 05:00 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Daniel Davidson wrote: >> > My new wireless network tested great, but now that I have rolled it out >> > to the entire building, I get error messages like: >> > >> > Mon May 2 15:15:06 2011 : Error: rlm_ldap: ldap_search() failed: Timed >> > out while waiting for server to respond. Please increase the timeout. > Make sure your LDAP server is up and reachable. > >> > The only existing firewalls are on the machines themselves and the ip >> > range of the servers are open with each other. Any ideas? > It's a networking issue and has nothing to do with FreeRADIUS. The > server is just a victim of the underlying problem. > > Alan DeKok. >

1 0

Multiple MACs per Network
by John Corps 03 May '11

03 May '11

Just a quick question, hope someone has an answer. Does anyone know how, or if its even possible, to do mac filtering for multiple networks? Say I have 1 AP with 2 WLAN SSIDs, I want list of macs allowed access to SSID1 but not SSID2 and list of macs allowed access to SSID2 and not SSID1. As far as I can see now it is a global list for mac authentication and will be applied to all SSIDs. I noticed in the "CALLED-STATION-ID it says the SSID at the end, for example 00-00-00-00-00-00:SSID. If anyone has any insight into this, that would be greatly appreciated. Thanks.

2 10

freeradius authentification ldap and windows 7 (PEAP mschapv2)
by rene.gomez＠laposte.net 03 May '11

03 May '11

Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

Mikrotik-Rate-Limit issue
by speedlnx 02 May '11

02 May '11

Hello, i'm migrating from freeradius 1.x to freeradius 2.1.10 on debian. I've replicated all the configuration i have on the old radius to the new and I import a dump of the mysql database on the new mysql server but i've an issue when i try to authenticate my users: radtest xxxxxxx.xxxxxx xxxxxx localhost 1812 mysupersecretpwd Sending Access-Request of id 18 to 127.0.0.1 port 1812 User-Name = "xxxxxxx.xxxxxx" User-Password = "xxxxxx" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=18, length=20 The freeradius debug give me this: Sun May 1 13:24:02 2011 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 36449, id=18, length=64 User-Name = "xxxxxxx.xxxxxx" User-Password = "xxxxxx" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Sun May 1 13:24:29 2011 : Info: # Executing section authorize from file /etc/freeradius/radiusd.conf Sun May 1 13:24:29 2011 : Info: +- entering group authorize {...} Sun May 1 13:24:29 2011 : Info: ++[preprocess] returns ok Sun May 1 13:24:29 2011 : Info: ++[chap] returns noop Sun May 1 13:24:29 2011 : Info: ++[mschap] returns noop Sun May 1 13:24:29 2011 : Info: [suffix] No '@' in User-Name = "xxxxxxx.xxxxxx", looking up realm NULL Sun May 1 13:24:29 2011 : Info: [suffix] No such realm "NULL" Sun May 1 13:24:29 2011 : Info: ++[suffix] returns noop Sun May 1 13:24:29 2011 : Info: [sql] expand: %{User-Name} -> xxxxxxx.xxxxxx Sun May 1 13:24:29 2011 : Info: [sql] sql_set_user escaped user --> 'xxxxxxx.xxxxxx' Sun May 1 13:24:29 2011 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Sun May 1 13:24:29 2011 : Info: [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' and attivato=1 ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'xxxxxxx.xxxxxx' and attivato=1 ORDER BY id Sun May 1 13:24:29 2011 : Debug: WARNING: Found User-Password == "...". Sun May 1 13:24:29 2011 : Debug: WARNING: Are you sure you don't mean Cleartext-Password? Sun May 1 13:24:29 2011 : Debug: WARNING: See "man rlm_pap" for more information. Sun May 1 13:24:29 2011 : Info: [sql] User found in radcheck table Sun May 1 13:24:29 2011 : Info: [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'xxxxxxx.xxxxxx' ORDER BY id Sun May 1 13:24:29 2011 : Error: rlm_sql: Failed to create the pair: Invalid octet string "512k/2048k 512k/2048k 192k/960k 8/8 1 128k/128k" for attribute name "Mikrotik-Rate-Limit" Sun May 1 13:24:29 2011 : Error: rlm_sql (sql): Error getting data from database Sun May 1 13:24:29 2011 : Error: [sql] SQL query error; rejecting user Sun May 1 13:24:29 2011 : Debug: rlm_sql (sql): Released sql socket id: 4 Sun May 1 13:24:29 2011 : Info: ++[sql] returns fail Sun May 1 13:24:29 2011 : Info: Delaying reject of request 0 for 1 seconds Sun May 1 13:24:29 2011 : Debug: Going to the next request Sun May 1 13:24:29 2011 : Debug: Waking up in 0.9 seconds. Sun May 1 13:24:30 2011 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 18 to 127.0.0.1 port 36449 Sun May 1 13:24:30 2011 : Debug: Waking up in 4.9 seconds. Sun May 1 13:24:35 2011 : Info: Cleaning up request 0 ID 18 with timestamp +27 Sun May 1 13:24:35 2011 : Info: Ready to process requests. I've of course the mikrotik dictionary with the correct attribute and there's a record in the database with the rate limit for the user in radreply table. Any idea? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Mikrotik-Rate-Limit-issue-tp4363178… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

Help with freeradius 2.1 with Mikrotik parameter
by Michell 02 May '11

02 May '11

Hello people, I just did an installation with debian squeeze freeradius / freeradius-mysql 2.1.10 + dfsg-2. He had previously debian Etch with freeradius 1.1.1-3 installed and running normally. I made corrections to the layout settings in the current package, the service starts normally. But when I radtest a user with a connection to the Mikrotik get the following error: "Failed to create the pair: Invalid octet string 2M/2M" for attribute name "Mikrotik-Rate-Limit." Mikrotik-Rate-Limit in the dictionary of my radius server. I use this setting usually in version 1.x. I've made several changes to this field and all I return the same error. Removing this information from the user table radgroupreply normally connects. Any suggestions? I thank the attention and help from you. - Mon May 2 17:11:56 2011: Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql # 4 Mon May 2 17:11:56 2011: Info: rlm_sql_mysql: Starting connect to MySQL server for # 4 Mon May 2 17:11:56 2011: Info: rlm_sql (sql): Connected new DB handle, # 4 Mon May 2 17:11:56 2011: Info: Loaded virtual server <default> Mon May 2 17:11:56 2011: Info: Ready to process requests. Mon May 2 17:12:04 2011: Error: rlm_sql: Failed to create the pair: Invalid octet string 2M/2M "for attribute name" Mikrotik-Rate-Limit " Mon May 2 17:12:04 2011: Error: rlm_sql (sql): Error getting date from database Mon May 2 17:12:04 2011: Error: [sql] SQL query error; Rejecting user Mon May 2 17:12:04 2011: Auth: Invalid user: [User @ domain / password] (from client localhost port 0)

1 1

Mac Auth - Timeout Connecting WiFi
by John Corps 02 May '11

02 May '11

Hello, I had freeradius setup and running perfectly on an ubuntu test machine and now I have done the exact same setup and configuration on a new debian machine with the addition of daloradius for easy configuration by other members of the team. I am running latest freeradius 2.1.10. The ubuntu machine was working perfect for mac auth but now this setup is not working. I try and connect to the WiFi and it always times out. Putting freeradius in debug mode shows nothing useful, it shows that it's sending the access accept packet but the connection times out still. Here is a sample debug, if anyone can be of any assistance it would be great. For reference, I change my AP back to the ubuntu server to do the radius mac auth and connect to the wifi and it sends the access accept and connects right away. Maybe I am missing something here....I don't think its an issue using sql as the ubuntu machine isn't using sql but if i disable sql and use exact config etc the time out still occurs. Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.55 port 1030, id=0, length=160 User-Name = "00-1E-58-F9-A6-94" User-Password = "NOPASSWORD" NAS-IP-Address = 192.168.1.55 Called-Station-Id = "00-20-B0-E6-12-A6:TEST" Calling-Station-Id = "00-1E-58-F9-A6-94" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0x946f027f36890c6b16ec5b4132e8e1d9 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "00-1E-58-F9-A6-94", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 00-1E-58-F9-A6-94 [sql] sql_set_user escaped user --> '00-1E-58-F9-A6-94' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00-1E-58-F9-A6-94' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '00-1E-58-F9-A6-94' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '00-1E-58-F9-A6-94' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 00-1E-58-F9-A6-94 [sql] sql_set_user escaped user --> '00-1E-58-F9-A6-94' [sql] expand: %{User-Password} -> NOPASSWORD [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '00-1E-58-F9-A6-94', 'NOPASSWORD', 'Access-Accept', '2011-04-27 15:33:47') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '00-1E-58-F9-A6-94', 'NOPASSWORD', 'Access-Accept', '2011-04-27 15:33:47') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.1.55 port 1030 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.55 port 1030, id=0, length=160 Sending duplicate reply to client AP01 port 1030 - ID: 0 Sending Access-Accept of id 0 to 192.168.1.55 port 1030 Waking up in 1.9 seconds. Cleaning up request 0 ID 0 with timestamp +4732 Ready to process requests.

3 5