- Freeradius-Users - lists.freeradius.org

UTF-8 UaseName permit?
by ziyen 11 Apr '11

11 Apr '11

Hi I want to use UserName as chinese UTF-8 characters type. is't special config? olso it permit? Thanks

2 1

Duplicate Accounting maybe once, twice a day
by Marius Pesé 11 Apr '11

11 Apr '11

Hi everyone, we are having an issue on our FreeRadius setup where our redundant servers will maybe once, twice a day create duplicate accounting entries. I have switched the servers to debug for a full day and caught one of these incidents in the log file, see attached. The strange thing is it only happens maybe once a day, regardless of realm or user, and the other couple of hundred accounting requests are fine. Can anyone see why this particular one would bounce back and forth? Our setup consists of two virtually identical FreeRadius2 servers, each with their own mySQL database, so each of them is capable of doing Auth and Acct, and proxies Acct to the other one. Also I changed the acct_update_alt query to write to a failover table since I thought this was the alt query being triggered, but this does not make a difference. Still duplicates in radacct table. Thanks! Marius __________________________________________ Marius Pesé Senior Software Developer B.Sc. Computer Science [cid:image003.jpg@01CBF85B.77F8AF50]<http://www.mindspring.co.za/> Unit 5, Doncaster Office Park Mindspring Computing Punters Way, Kenilworth P O Box 46926 Cape Town, South Africa Glosderry 7702 Phone: +27 21 657 1780 Fax : +27 21 671 7599 Cell : 072 100 70 73 E-mail: marius(a)mindspring.co.za<mailto:marius@mindspring.co.za>

1 0

Freeradius proxy caching users
by Ivan Luska 11 Apr '11

11 Apr '11

Hello, I use Freeradius as proxy server. Is it possible to cache authenticated users on the proxy and resend access-accept to these users, if home server fails? Ivan Luska

3 2

FR and AD with ntlm and Users group
by Raheel Itrat 11 Apr '11

11 Apr '11

Hi, I am authenticating my Cisco devices by integrating FreeRadius with Active Directory. Not using LDAP but ntlm_auth. Now If I make a group on my AD server for example Router Admins and put some users in it. Now, where would I define in the FreeRadius that only users from Router Admin group are permitted. Do I need to define it in the smb.conf? BR, Raheel

1 0

problem in assigning Tunnel-Private-Group-ID
by syharash 11 Apr '11

11 Apr '11

Hi, My freeradius is set and working fine, the authentication is successful on a windows XP machine on the wireless network. I am using Cisco Switches and Ruckus Zone Director 1000 with Ruckus AP's. They are connected to the switches on the trunk ports with all vlans allowed. I get the following PEAP output; [peap] Got tunneled reply code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Service-Type = Framed-User Tunnel-Private-Group-Id:0 = "18" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x4f6c9d87690bee0a58553bc0511d5d8b MS-MPPE-Recv-Key = 0x3a8d8e6495f46657b8eb7fd7de5414ca EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "abdul" [peap] Got tunneled reply RADIUS code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Service-Type = Framed-User Tunnel-Private-Group-Id:0 = "18" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x4f6c9d87690bee0a58553bc0511d5d8b MS-MPPE-Recv-Key = 0x3a8d8e6495f46657b8eb7fd7de5414ca EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "abdul" [peap] Tunneled authentication was successful. but the machine does not get the IP address from the vlan id assigned to it, i get this output; [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 182 to 10.73.93.151 port 1036 EAP-Message = 0x010b00261900170301001b02e15cc2abe26c501fdcd17fcd4f071c3f8a537b5dd5b0ebb210e9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5b2c3d415227240db5e9ddff32a6a83d Finished request 9. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 10.73.93.151 port 1036, id=183, length=231 User-Name = "abdul" Calling-Station-Id = "00-1F-3C-E1-17-A9" NAS-IP-Address = 10.73.93.151 NAS-Port = 1 Called-Station-Id = "AC-67-06-39-CB-0D" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AC-67-06-39-CB-0D" Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020b00261900170301001bbb6ec9c29da3419792e34574056635e11eee7834778d5fad460595 State = 0x5b2c3d415227240db5e9ddff32a6a83d Vendor-25053-Attr-3 = 0x55464f4d6f7669657a Message-Authenticator = 0x4263907cbffb8eec9f8b93a9138037dd # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "abdul", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [abdul] (from client UFO-Network port 1 cli 00-1F-3C-E1-17-A9) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 183 to 10.73.93.151 port 1036 MS-MPPE-Recv-Key = 0x2427d16802fc1cc49ddea287efb9c9d5ba0f8698cc2a9ea300c43d46d720a4d5 MS-MPPE-Send-Key = 0xc3d215b48856c14b29eb75f29b0fbeb6c3a3c83ed5d657259df03cb3759c4d9f EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "abdul" Finished request 10. Going to the next request Waking up in 4.5 seconds. Cleaning up request 0 ID 173 with timestamp +8 Waking up in 0.3 seconds. Cleaning up request 1 ID 174 with timestamp +9 Cleaning up request 2 ID 175 with timestamp +9 Cleaning up request 3 ID 176 with timestamp +9 Cleaning up request 4 ID 177 with timestamp +9 Cleaning up request 5 ID 178 with timestamp +9 Cleaning up request 6 ID 179 with timestamp +9 Cleaning up request 7 ID 180 with timestamp +9 Cleaning up request 8 ID 181 with timestamp +9 Cleaning up request 9 ID 182 with timestamp +9 Cleaning up request 10 ID 183 with timestamp +9 Ready to process requests. rad_recv: Accounting-Request packet from host 10.73.93.151 port 1044, id=184, length=213 User-Name = "abdul" Acct-Status-Type = Start Acct-Authentic = RADIUS Framed-IP-Address = 169.254.67.194 Calling-Station-Id = "00-1F-3C-E1-17-A9" NAS-IP-Address = 10.73.93.151 NAS-Port = 1 Called-Station-Id = "AC-67-06-39-CB-0D" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AC-67-06-39-CB-0D" Connect-Info = "AC-67-06-39-CB-0D" Acct-Session-Id = "4D9EBE6D-00000037" Acct-Multi-Session-Id = "ac670639cb0d001f3ce117a94d9f077c00d2" Vendor-25053-Attr-3 = 0x55464f4d6f7669657a # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 10.73.93.151,NAS-IP-Address = 10.73.93.151,Acct-Session-Id = "4D9EBE6D-00000037",User-Name = "abdul"' [acct_unique] Acct-Unique-Session-ID = "c55f8220b641e9bd". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "abdul", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/10.73.93.151/detail-20110408 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/10.73.93.151/detail-20110408 [detail] expand: %t -> Fri Apr 8 18:38:10 2011 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> abdul ++[radutmp] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> abdul attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 184 to 10.73.93.151 port 1044 Finished request 11. Cleaning up request 11 ID 184 with timestamp +68 Going to the next request Ready to process requests. I have checked the /etc/raddb/users, which looks like this; DEFAULT Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Service-Type = Framed-User, Fall-Through = Yes abdul Cleartext-Password := "test123" Tunnel-Private-Group-ID = 18 Is there anything that I need to do on the FreeRadius or is it my switches or the Zone Director which is the culprit. Please help. Syed -- View this message in context: http://freeradius.1045715.n5.nabble.com/problem-in-assigning-Tunnel-Private… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Simple "Guest user" web front end for FreeRADIUS
by up＠3.am 11 Apr '11

11 Apr '11

On my client's wifi network, we are authenticating staff users via FreeRADIUS against the corporate LDAP database. I've created a new SSID/WLAN with an IP pool that I've restricted through router ACLs that we want to deploy for temporary "guest" users. I can set up a new FreeRADIUS server (I've done many of those) backend for this, but am unfamiliar with 2 things that will be different here, which are: 1) A Web front end for a clerical type to enter in temporary accounts to FreeRADIUS. I imagine there must be a simple php interface for some sort of "Internet cafe" type of use. I'd prefer as simple as possible (ie, flat file), but would be fine if MySQL is the way to go for account info storage. I know I COULD put together a FreeRADIUS and OpenLDAP server with something like a webmin front end, but that seems overkill to me. 2) Some sort of automatic password generator for above...not absolutely necessary, but would be nice. I would imagine this wheel has already been invented, so if anybody could point me in the right direction, it would be appreciated. Thanks!

4 4

Something about the commonName of client certificate
by xuyu 10 Apr '11

10 Apr '11

Hi! I want to build eap/tls so i need to produce a client certificate. in the certs catalog there are ca.pem and server.pem,but not client.pem.so I should use command "make client.pem". in the README file there are some words:"Be sure that the commonName field here is the User-Name that will be used for logins!" Does it mean ommonName must the same with the login name in the eapol_test ? thank you for your help ,best regards.

1 0

associating mac addresses with usernames
by Stephen Vigus 10 Apr '11

10 Apr '11

Hi all First post to the list ;) I want to use both mac authentication and username authentication. I have both working fine separately from mysql, but I want associate certain mac addresses to certain usernames and have it authenticate with the username. I thought I could use the following to authenticate mac addresses: if("%{sql:SELECT radusergroup.username FROM authorized_macs LEFT JOIN radusergroup ON ( authorized_macs.username = radusergroup.username ) WHERE authorized_macs.macaddr = ''%{User-Name}'}" > 0){ ok } else{ reject } In mysql this query would display the username associated to the mac (eg, user1@realm1), although it seems freeradius does not like this. Can anyone point me in the right direction so freeradius would think its "user1@realm1" authenticating when it receives the mac address? thanks Stephen

2 3

how to radtest from another client
by 徐宇 09 Apr '11

09 Apr '11

I install freeradius in the server its ip is 192.168.1.1. In the server I have already do the radtest ,and the result is OK rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=11, length=20 I want to add a test authenticator host client. So I add something at the end of my clients.conf and assign a shared-secret. client 192.168.1.100 { secret = testing123 shortname = 192.168.1.100 } Should I do other things to finish it? I need to do the radtest in the client(192.168.1.100) right? But there isn't a radtest command in the client, Need I install some softwares in the client? thank you for your help ,best regards.

3 5

rlm_sql_unixodbc ?
by Jim Rice 08 Apr '11

08 Apr '11

Quick question: I am looking into adding an ACT! Plugin to populate the Radius MySQL database through unix ODBC. Found rlm_sql_unixodbc and wondered if this is already provided for this purpose, or something else? Looks like it needs to be run through "make"... (not installed by default). Otherwise, I can go through the steps for installing mysql-connector-odbc and friends. Thanks, Jim

4 11