- Freeradius-Users - lists.freeradius.org

Different sql servers for separated auth&acc
by c.schwarz＠funknetz.at 12 Apr '11

12 Apr '11

Hello, in a special setup we are using freeradius Version 1.1.3 (sql.conf v 1.41.2.2.2.2), on a debian x86 machine, which can't be upgraded to Version >2.0. I would like to check authorization against mysqldb1 and insert/update accounting in mysqldb2. Is it possible to use two independent mysql databases in Version 1.1.3? Thanks in advance, chris

2 1

Authentication based on users and NAS
by Sergio Belkin 12 Apr '11

12 Apr '11

Hi, It was easier than I thought, I simply had to add to /etc/raddb/users something like: steve Called-Station-Id == "00259c14066e",Cleartext-Password := "password" Still I had to solve 2 issues: The first one is that if I want steve to login through more than NAS I have to add one line like above per NAS. Is a nicer way to do it? The second one is that I don't know how to do it for Ldap users. Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

1 0

How to add RADIUS users under OU=People
by pradyumna dash 12 Apr '11

12 Apr '11

Hello, I need a help, What i want is instead of creating a OU called radius, i would like to add all radius users under OU=People, how to achieve this? I am not able to add a user with "objectclass:radiusprofile", I tried changing radius schema to AUX but no luck. Please have a look at my LDIF file. I am using SuSE 11 dn: uid=kris,ou=People,dc=example,dc=com uid: kris cn: kris objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: uidObject objectClass: radiusprofile userPassword: {crypt}$2a$10$DXf3RUs5cQv/WYOgaeyv1uwvUJ.3ZfW3sr7sCr75/6/dw062c5YOe shadowLastChange: 15076 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 1003 gidNumber: 100 homeDirectory: /home/krisradiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None radiusGroupName: dial radiusGroupName: isdn radiusAuthType: LDAP Suggestions will be appreciated. /Neo

1 0

freeradius, how to cooperate with a wireless AP( system is linux, openwrt)
by xuyu 12 Apr '11

12 Apr '11

Hi,I want to build a wireless network with radius server . server computer is ubuntu , wireless router is a linux system-openwrt.So i need to install something in the router,So what is it? Can somebody know something about it? please do me a favor.

2 1

Help me with Access-Challenge configuration
by GreenUA 12 Apr '11

12 Apr '11

I reviewed RFC and FAQ, but i can't fined sane info about configuration of freeRADIUS server (on Windows) to send access-challenge message on access-request. My configuration is (users.conf): test Auth-Type := Local, User-Password == "test" Service-Type = Login-User, Login-IP-Host = 192.99.98.119, Login-Service = Telnet, CS_Priv_Level = 2, Reply-Message = "Hello, %u. Wellcome from RADIUS. You are Administrator" For such configuration RADIUS server (receive access-request)checks Login + Pass and if they are correct sends "Reply-Message" with right "CS_Priv_Level" for Client (access-accept). But i need to validate one more parameter from client and sent for him access-challenge, and i don't know how to configure my RADIUS server to send "Access-challenge". Guys pls help me with the answer or if it's possible give me some link or manual in which i can fined the answer. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-me-with-Access-Challenge-confi… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 11

new to radius osx client 3com switch
by jeffrey j donovan 12 Apr '11

12 Apr '11

hello I have been learning about freeradius and could use some guidance. I have a freeradius server a 3com 5500 switch and mac osx client I setup a test machine and added a client record and shared secret. Joe User is getting his credentials from ldap, and the machine he sent the request on is 10.5.1.8, freeradius running on 10.5.1.101. Now I need to configure a 3Com switch, and mac OSX client to send/accept EAP or EAPTLS. neither apple or 3com have good setup docs, so Im looking to the list , maybe someone has crossed this river before I build a new bridge ? here was my auth test from remote user; echo "User-Name = joeuser\n User-Password = hispassword" | radclient -sx 10.5.1.101 auth Secret Sending Access-Request of id 137 to 10.5.1.101 port 1812 User-Name = "joeuser" User-Password = "hispassword" rad_recv: Access-Accept packet from host 10.5.1.101:1812, id=137, length=20 Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 Mon Apr 11 20:17:42 2011 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 10.5.1.8 port 57337, id=254, length=51 User-Name = "joeuser" User-Password = "hispassword" Mon Apr 11 20:27:04 2011 : Info: +- entering group authorize {...} Mon Apr 11 20:27:04 2011 : Info: ++[preprocess] returns ok Mon Apr 11 20:27:04 2011 : Info: ++[chap] returns noop Mon Apr 11 20:27:04 2011 : Info: ++[mschap] returns noop Mon Apr 11 20:27:04 2011 : Info: [suffix] No '@' in User-Name = "joeuser", looking up realm NULL Mon Apr 11 20:27:04 2011 : Info: [suffix] No such realm "NULL" Mon Apr 11 20:27:04 2011 : Info: ++[suffix] returns noop Mon Apr 11 20:27:04 2011 : Info: [eap] No EAP-Message, not doing EAP Mon Apr 11 20:27:04 2011 : Info: ++[eap] returns noop Mon Apr 11 20:27:04 2011 : Info: ++[unix] returns updated Mon Apr 11 20:27:04 2011 : Info: ++[files] returns noop Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: The host 10.5.1.8 does not have an access group. Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: no access control groups, all users allowed. Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: Setting Auth-Type = opendirectory Mon Apr 11 20:27:04 2011 : Info: ++[opendirectory] returns ok Mon Apr 11 20:27:04 2011 : Info: ++[expiration] returns noop Mon Apr 11 20:27:04 2011 : Info: ++[logintime] returns noop Mon Apr 11 20:27:04 2011 : Info: [pap] Found existing Auth-Type, not changing it. Mon Apr 11 20:27:04 2011 : Info: ++[pap] returns noop Mon Apr 11 20:27:04 2011 : Info: Found Auth-Type = opendirectory Mon Apr 11 20:27:04 2011 : Info: +- entering group opendirectory {...} Mon Apr 11 20:27:04 2011 : Info: ++[opendirectory] returns ok Mon Apr 11 20:27:04 2011 : Auth: Login OK: [joeuser/hispassword] (from client noc port 0) Mon Apr 11 20:27:04 2011 : Info: +- entering group post-auth {...} Mon Apr 11 20:27:04 2011 : Info: ++[exec] returns noop Sending Access-Accept of id 254 to 10.5.1.8 port 57337 Mon Apr 11 20:27:04 2011 : Info: Finished request 2. Mon Apr 11 20:27:04 2011 : Debug: Going to the next request Mon Apr 11 20:27:04 2011 : Debug: Waking up in 4.9 seconds. okay so thats good. now I assume that I can configure the switch , after following 3coms instructions i end up with 5500G-EI]display dot1x int g1/0/5 Equipment 802.1X protocol is enabled CHAP authentication is enabled DHCP-launch is disabled Proxy trap checker is disabled Proxy logoff checker is disabled Configuration: Transmit Period 30 s, Handshake Period 15 s Quiet Period 60 s, Quiet Period Timer is disabled Supp Timeout 30 s, Server Timeout 100 s The maximal retransmitting times 2 Total maximum 802.1x user resource number is 1024 Total current used 802.1x resource number is 1 GigabitEthernet1/0/5 is link-up 802.1X protocol is enabled Proxy trap checker is disabled Proxy logoff checker is disabled The port is a(n) an authenticator Authenticate Mode is Auto Port Control Type is Mac-based Max on-line user number is 256 Authentication Success: 0, Failed: 2 EAPOL Packets: Tx 13, Rx 12 Sent EAP Request/Identity Packet : 5 EAP Request/Challenge Packets: 5 Received EAPOL Start Packets : 3 EAPOL LogOff Packets: 0 EAP Response/Identity Packets : 5 EAP Response/Challenge Packets: 0 Error Packets: 0 1. Unauthenticated user : MAC address: 0025-xxxx-xxxx Controlled User(s) amount to 1 [5500G-EI] disp domain 0 Domain = nocdomain State = Active RADIUS Scheme = nocsys Access-limit = Disable Domain User Template: Idle-cut = Disable Self-service = Disable Messenger Time = Disable 1 Domain = system State = Active Scheme = LOCAL Access-limit = Disable Domain User Template: Idle-cut = Disable Self-service = Disable Messenger Time = Disable at this point I thought I had it, but the OSX client just fails and it's like the eap never leaves the 3com switch nothing hits the logs, it's quiet. so, I need to know what each side is looking for. can someone smack me around a bit thanks for any insight -j

1 0

MLPPP Acct-Session-Id
by Jay Kuhne (jkuhne) 11 Apr '11

11 Apr '11

Hi, Is there another attribute syntax on radclient that could be used aside from Acct-Session-Id to perform COA to a session We are using MultilinkPPP (single session per bundle still) and it is not working as it normally would with PPP. Thanks, Jay RADIUS: COA received from id 48 x.x.x.99:1052, CoA Request, len 149 COA: x.x.x.20 request queued RADIUS: authenticator 70 8D C4 4D 97 82 50 02 - 73 6B 53 27 81 52 29 BD RADIUS: User-Name [1] 25 "user1(a)5_6_mlp.com1" RADIUS: Acct-Session-Id [44] 10 "000110A4" RADIUS: Vendor, Cisco [26] 46 RADIUS: Cisco AVpair [1] 40 "ip:sub-qos-policy-in=policy_session_in_coa" RADIUS: Vendor, Cisco [26] 48 RADIUS: Cisco AVpair [1] 42 "ip:sub-qos-policy-out=policy_session_out_coa" COA: Message Authenticator missing or failed decode ++++++ CoA Attribute List ++++++ 7FD2EA5DA700 0 00000009 username(447) 23 user1(a)asr_5_6_mlp.com1 7FD2EA5DB090 0 00000001 session-id(409) 4 69796(110A4) 7FD2EA5DB0A8 0 00000009 sub-qos-policy-in(421) 17 policy_session_in_coa 7FD2EA5DB0C0 0 00000009 sub-qos-policy-out(423) 18 policy_session_out_coa RADIUS/ENCODE(00000000):Orig. component type = Invalid RADIUS(00000000): sending RADIUS(00000000): Send CoA Nack Response to x.x.x.99:1052 id 48, len 157 RADIUS: authenticator 76 2F 9A 52 29 2C 26 57 - 27 F6 E0 CC A6 E6 F1 13 RADIUS: User-Name [1] 25 "user1(a)5_6_mlp.com1" RADIUS: Vendor, Cisco [26] 43 RADIUS: Cisco AVpair [1] 37 "sub-qos-policy-in=policy_session_in_coa" RADIUS: Vendor, Cisco [26] 45 RADIUS: Cisco AVpair [1] 39 "sub-qos-policy-out=policy_session_out_coa" RADIUS: Reply-Message [18] 18 RADIUS: 4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E [ No valid Session] RADIUS: Dynamic-Author-Error[101] 6 Unsupported Service [405]

3 11

LDAP-group filter search is failing
by joezamosc 11 Apr '11

11 Apr '11

2.1.10 Here's a snippet of freeradius -X... +- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=Departments,dc=corp,dc=development,dc=com -> ou=Departments,dc=corp,dc=development,dc=com [files] expand: (&(sAMAccountName=%{mschap:User-Name})) -> (&(sAMAccountName=RobertTest1)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(sAMAccountName=RobertTest1)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(cn=WANN)(|(&(objectClass=GroupOfNames)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=RobertTest1,OU=WANN,OU=Departments,DC=corp,DC=development,DC=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop Sending Access-Accept of id 100 to 192.168.100.2 port 1645 User-Name = "DEVELOPMENT\\RobertTest1" MS-MPPE-Recv-Key = 0xa873077b6643bb983d8dbf04da66667699d7832fe38f78c5458b0318eaa27db6 MS-MPPE-Send-Key = 0x866779d60ae2e9da0a928ebfb1f20e2f5e26dc05d050075dc8e65210e2946936 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. This is in my postauth_users file... DEFAULT Huntgroup-Name == Switches, Ldap-Group == "WANN" Service-Type = "Framed-User", Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "dragons_cave" The 10th line from the bottom of the snippet returns with the following... rlm_ldap::ldap_groupcmp: ldap_get_values() failed I'm waiting for a subsequent "[ldap] performing search in" my DN and to match with filter (cn=WANN) But it's not happening. Any insight? Thx. Joe -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-group-filter-search-is-failing… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

UTF-8 UaseName permit?
by ziyen 11 Apr '11

11 Apr '11

Hi I want to use UserName as chinese UTF-8 characters type. is't special config? olso it permit? Thanks

2 1

Duplicate Accounting maybe once, twice a day
by Marius Pesé 11 Apr '11

11 Apr '11

Hi everyone, we are having an issue on our FreeRadius setup where our redundant servers will maybe once, twice a day create duplicate accounting entries. I have switched the servers to debug for a full day and caught one of these incidents in the log file, see attached. The strange thing is it only happens maybe once a day, regardless of realm or user, and the other couple of hundred accounting requests are fine. Can anyone see why this particular one would bounce back and forth? Our setup consists of two virtually identical FreeRadius2 servers, each with their own mySQL database, so each of them is capable of doing Auth and Acct, and proxies Acct to the other one. Also I changed the acct_update_alt query to write to a failover table since I thought this was the alt query being triggered, but this does not make a difference. Still duplicates in radacct table. Thanks! Marius __________________________________________ Marius Pesé Senior Software Developer B.Sc. Computer Science [cid:image003.jpg@01CBF85B.77F8AF50]<http://www.mindspring.co.za/> Unit 5, Doncaster Office Park Mindspring Computing Punters Way, Kenilworth P O Box 46926 Cape Town, South Africa Glosderry 7702 Phone: +27 21 657 1780 Fax : +27 21 671 7599 Cell : 072 100 70 73 E-mail: marius(a)mindspring.co.za<mailto:marius@mindspring.co.za>

1 0