- Freeradius-Users - lists.freeradius.org

insert wrong record
by Moayad Mohammad 30 Dec '10

30 Dec '10

Dears, I noticed wrong record inserted to radacct table with as below: RadAcctId = 5653 AcctSessionId = 2000D19 AcctUniqueId = 3a4ec8ee9b364898 .. .. AcctStartTime = 2010-12-30 12:24:59 AcctStopTime = 2010-11-24 04:10:55 AcctSessionTime = 10800 AccStatusType = Interim-Update ... ... The AcctStopTime value older than AcctStartTime value, and the new session overwriting on the old record. I just found this problem in 1 record from all our records. AcctSessionId values are repeated on my freeradius, is it normal? Regards, Moayad

2 1

Reloading Freeradius configs via HUP
by Phil Pierotti 29 Dec '10

29 Dec '10

Hi All, So today I thought I'd try my hand at "nicely" reloading the freeradius config using signals rather than hard restarting the daemon. I added new config to the hints file and to the users file. Wed Dec 29 14:49:11 2010 : Info: Received HUP signal. Wed Dec 29 14:49:11 2010 : Info: Received HUP. Wed Dec 29 14:49:11 2010 : Info: Module: Reloaded module "suffix" Wed Dec 29 14:49:11 2010 : Info: Module: Reloaded module "auth_log" Wed Dec 29 14:49:11 2010 : Info: Module: Reloaded module "files" Wed Dec 29 14:49:11 2010 : Info: Module: Reloaded module "detail" Wed Dec 29 14:49:11 2010 : Info: Module: Reloaded module "attr_filter.access_reject" Wed Dec 29 14:49:11 2010 : Info: Module: Reloaded module "attr_filter.accounting_response" Wed Dec 29 14:49:11 2010 : Info: Module: Reloaded module "pap" Wed Dec 29 14:49:11 2010 : Info: Loaded virtual server status Wed Dec 29 14:49:11 2010 : Info: Loaded virtual server <default> Ok, so that looks good. However freeradius continued to act as if the configuration changes had not been made. I then went back and did a hard stop and start of freeradius, and now it is clearly using the new configs. Am I missing something? This should have just worked that simply, right? (before anyone asks the obvious, no I am not running in debug mode. I don't have any more detail on what it was thinking at the time) Phil P

5 6

CoA msg support in freeRadius
by Rajkumar R 28 Dec '10

28 Dec '10

Hi All, I'm a starter to freeRadius and request you to provide your inputs on my below queries. I'm trying to simulate a ISP flow, where based on vendorspecific AVPs (stored in the DB from Acct-Start msg)should trigger a COA msg as shown: NAS(RadClient here) RadiusServer -------------- Acct Start ---------------> <----------- Ack Acct Start ---------------- (Based on the Vendor-Specific-AVP) <------------- CoA -------------------------- ----------- CoA ack -----------------> Request to provide your inputs and help me on the below query: 1. Is there any configurations that would help in triggering the CoA msg upon the Acct Start msg processed results Or other helpful documents/links shared earlier with the forum would be helpful on this, as I could n't get the information from freeRadius search page. thanks Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 8

Problem with MS-CHAPV2 and Windows XP SP3
by Henrique Camolezi Pacheco 27 Dec '10

27 Dec '10

I'm trying to implement 802.1x and LDAP with freeradius, but am having problems with the certificate. When I try to authenticate, I get the following error message: Sending Access-Challenge of id 66 to 10.10.12.77 port 1825 Reply-Message = "Access-Accept " Idle-Timeout = 1 Session-Timeout = 1 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x232ca99e232eb03c24e354b343e4af25 Mon Dec 27 09:50:50 2010: Info: Finished request 4. Mon Dec 27 09:50:50 2010: Debug: Going to the next request Mon Dec 27 09:50:50 2010: Debug: Waking up in 4.9 seconds. Mon Dec 27 09:50:55 2010: Info: Cleaning up request 4 ID 66 with timestamp +1771 Mon Dec 27 09:50:55 2010: Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Dec 27 09:50:55 2010: Debug: WARNING:! EAP session state is 0x232ca99e232eb03c did not finish! Mon Dec 27 09:50:55 2010: Debug: WARNING:! Please read http://wiki.freeradius.org/Certificate_Compatibility Mon Dec 27 09:50:55 2010: Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Dec 27 09:50:55 2010: Info: Ready to process requests. I'm trying make 802.1x authentication, but I don't have sucessfull

2 1

about kick off oldest user
by Spacelee 27 Dec '10

27 Dec '10

Hi, everyone. I have set an attribute Simultaneous-Use := 1 to an account name Test, and when I use Test to double login, I will get the authentication failed the second time, what I want is when I login the second time, the server just kick off the first login of Test, is it possible? Do I need to change the source code if I need to implement this function? Thanks. -- *Space Lee*

4 3

Check in users file using a string attribute obtained from ldap
by Kostas Zorbadelos 24 Dec '10

24 Dec '10

Greetings to all, I am trying to accomplish the following setup: - have freeradius query an ldap server to get the usual user entry with one check and a few reply attributes - have after that a users file, that based on the check attribute obtained before by the ldap module make some processing (eg add a few common reply attributes) This is actually a "grouping" functionallity and I can accomplish what I want using the Ldap-Group attribute, BUT I want to avoid the extra ldap queries. So for example I have: LDAP ---------- # kzorba, people, company.gr dn: uid=kzorba1,ou=people,dc=company,dc=gr objectClass: XXX objectClass: YYY radiusProfile: FOO_STATIC Framed-IP-Address: 62.103.131.9 userPassword: XXXXXXX sn: ZORBADELOS uid: kzorba ... ldap.attrmap -------------- checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Ascend-Group radiusProfile replyItem Framed-IP-Address Framed-IP-Address replyItem Framed-Route Framed-Route replyItem Filter-Id Filter-Id And I want to have a users file that looks like this: DEFAULT Ascend-Group =~ "STATIC" Reply-Message = "Your account is Static." Having the following authorize section in default authorize { preprocess chap mschap ldap { notfound = reject } files pap } The checks fail. I looked at the source code and from what I understood the ldap module puts all check items in the so called control (or check list), while rlm_file makes checks in the request list So I figured that doing an unlang update request would solve the problem. authorize { preprocess chap mschap ldap { notfound = reject } update request { Group = "%{control:Ascend-Group}" } files pap } And in users file have a DEFAULT Group =~ "STATIC" Reply-Message = "Your account is Static." However this also did not work. Any help as to what am I missing here? Thanks, Kostas Zorbadelos

3 2

David Suarez De Lis/UN24956/OPERACION Y MANTENIMIENTO/TSM está ausente de la oficina.
by david.suarezdelis＠telefonica.es 24 Dec '10

24 Dec '10

Estaré ausente de la oficina desde el 23/12/2010 y no volveré hasta el 03/01/2011. Responderé a su mensaje cuando regrese. Si tiene alguna emergencia, puede contactar con Accesos_SOR@telefonica (900 111 245 opción 3, 2) o Jose Manuel Gomez Perez (jmgomez(a)telefonica.es) ¡Felices fiestas y próspero año nuevo! ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

1 0

Perl bindings for libfreeradius-radius
by Alexandr Kovalenko 23 Dec '10

23 Dec '10

Hello! Anyone aware of any perl module, which provide libfreeradius-radius interface? Thanks in advance! -- Alexandr Kovalenko http://uafug.org.ua/

2 3

Windows Client
by McCann, Brian 23 Dec '10

23 Dec '10

Hi all. I'm sure some of you are right away thinking "not this again", since this is probably something very simple, but I cannot figure this out. I've got an XP SP3 client, a Windows 7 SP1 client, and an iPad all trying to sign in to a WPA2 wireless network, that I have setup to auth with FreeRadius. The iPad works 100% of the time. The Windows XP client & Windows 7 do not. The most obvious thing in the debug log (whole snippit below) is the "EAP session for the state 0x.... did not finish!". I've followed the directions to disable certificate checking on Windows, and this continues to happen. I've re-ran "make" in the certs directory, and checked that the openssl lines do infact include the "xpextensions" file. Is there something else I should be doing here? I've been following the directions @ http://deployingradius.com/documents/configuration/pap.html , along with the FAQs at http://wiki.freeradius.org/Certificate_Compatibility . Thanks, --Brian

3 3

rlm_radutmp Error
by Moayad Mohammad 22 Dec '10

22 Dec '10

Dears, I am using freeradius2-2.1.7-7.el5, I got the following error in radius.log file "Error: rlm_radutmp: Logout entry for NAS ASN port 5 has wrong ID" As I noticed, this error appears only when NAS send stop record to radius server. What's the problem? And how can I solve it? Regards, Moayad

2 1