- Freeradius-Users - lists.freeradius.org

radtest and IPv6 support
by Panagiotis Georgopoulos 08 Jun '10

08 Jun '10

Hello all, I am trying to use radtest to test my freeradius configuration over IPv6. I have configured IPv6 on my freeradius server and a client machine from which I am firing radtest. However when I issue "radtest bob hello 2001:db95::100 100 testing123" on my client I get a "radclient: socket: cannot initialize udpfromto: Function not implemented" Google returns a few people reporting this, but answers are related to changing how localhost is resolved when testing it from the freeradius server. Is there a proper solution for using radtest over IPv6 from a remote machine? Btw radtest works fine over IPv4 on my current setup. Thanks a lot, Panos

3 7

authenticate fails
by Spacelee 08 Jun '10

08 Jun '10

radtest says: radtest test test localhost 2313 12345678 Sending Access-Request of id 142 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port = 2313 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=142, length=20 and the radius server says: rad_recv: Access-Request packet from host 127.0.0.1 port 39501, id=142, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port = 2313 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry test at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No MS-CHAP-Challenge in the request ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 142 to 127.0.0.1 port 39501 Waking up in 4.9 seconds. Cleaning up request 0 ID 142 with timestamp +38 Ready to process requests. I don't know why it fails -- Spacelee

2 1

reset sqlcounter on the same day for each user
by Антон Зайцев 08 Jun '10

08 Jun '10

Hello everyone. Need some help. I want to limit my users with MB traffic monthly. I have set up sqlcounter and it works great. But it resets in month starting user first connect to NAS. Users can register and connect on different day during the month and then it resets differently for each user. And this is the question. How can i reset counter on the certain day for certain user(example last day of month).And then counter can resets monthly for all users beginning from the first day of month. Maybe I need some attributes or ... Thanks

2 1

i install freeradius successfully, but i can't telnet the port
by Spacelee 08 Jun '10

08 Jun '10

i can start freeradius ok, but my pptp can't remote access radius server, I telnet 1812 or 1813 , but both are connection refused, i don't know what to do with this situation -- Spacelee

4 11

unsubscribe
by Tawanda Kavayi 08 Jun '10

08 Jun '10

1 0

Rewriting Exec-Program-Wait
by Mindaugas Riauba 08 Jun '10

08 Jun '10

Hello, Just upgraded to freeradius2 2.1.7 on CentOS 5.5. And Exec-Program-Wait no longer works now for accounting packets. Rewrote to exec module. But for performance reasons we were not executing external program for all the packets before. We used more specific user entries in users and acct_users files to return result without executing program. Like: DEFAULT Auth-Type := Accept, NAS-Identifier == "company", Calling-Station-Id =~ "^49", 3GPP-SGSN-Address =~ "^10.20.20." DEFAULT Auth-Type := Accept Exec-Program-Wait = "/etc/raddb/external-auth" How to change that to exec module syntax? So that external-auth would not be called for certain packets? Regards, Mindaugas

1 0

reauth-problem with WPA2-tls
by Andreas Hartmann 07 Jun '10

07 Jun '10

Hello, I'm using freeradius 2.1.8 with wpa_supplicant 0.7.1, both on 32bit-linux with openssl 1.0.0 or openssl 0.9.8. AP is a Linksys WAP610N. In eap.conf, the option eap -> tls -> cache -> enable is switched off and fast_reauth in wpa_supplicant is enabled. The initial login works fine. But there seems to be a problem to fill the cache during initial login: rad_recv: Access-Request packet from host 192.168.1.9 port 2048, id=50, length=178 User-Name = "myuser@mydom" NAS-Port = 0 Called-Station-Id = "00-25-....:mywlan" Calling-Station-Id = "00-13-..." Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020800060d00 State = 0x89d58d3e8edd800104fb11e3a0338e57 Message-Authenticator = 0xe8f5eca1715e4bd2ecfa23c444efe859 Wed Jun 2 20:29:14 2010 : Info: +- entering group authorize {...} Wed Jun 2 20:29:14 2010 : Info: ++[preprocess] returns ok Wed Jun 2 20:29:14 2010 : Info: ++[chap] returns noop Wed Jun 2 20:29:14 2010 : Info: ++[mschap] returns noop Wed Jun 2 20:29:14 2010 : Info: [suffix] Looking up realm "mydom" for User-Name = "myuser@mydom" Wed Jun 2 20:29:14 2010 : Info: [suffix] No such realm "mydom" Wed Jun 2 20:29:14 2010 : Info: ++[suffix] returns noop Wed Jun 2 20:29:14 2010 : Info: [eap] EAP packet type response id 8 length 6 Wed Jun 2 20:29:14 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Jun 2 20:29:14 2010 : Info: ++[eap] returns updated Wed Jun 2 20:29:14 2010 : Info: ++[unix] returns notfound Wed Jun 2 20:29:14 2010 : Info: [files] users: Matched entry myuser@mydom at line 203 Wed Jun 2 20:29:14 2010 : Info: ++[files] returns ok Wed Jun 2 20:29:14 2010 : Info: ++[expiration] returns noop Wed Jun 2 20:29:14 2010 : Info: ++[logintime] returns noop Wed Jun 2 20:29:14 2010 : Info: ++[pap] returns noop Wed Jun 2 20:29:14 2010 : Info: Found Auth-Type = EAP Wed Jun 2 20:29:14 2010 : Info: +- entering group authenticate {...} Wed Jun 2 20:29:14 2010 : Info: [eap] Request found, released from the list Wed Jun 2 20:29:14 2010 : Info: [eap] EAP/tls Wed Jun 2 20:29:14 2010 : Info: [eap] processing type tls Wed Jun 2 20:29:14 2010 : Info: [tls] Authenticate Wed Jun 2 20:29:14 2010 : Info: [tls] processing EAP-TLS Wed Jun 2 20:29:14 2010 : Info: [tls] Received TLS ACK Wed Jun 2 20:29:14 2010 : Info: [tls] ACK handshake is finished Wed Jun 2 20:29:14 2010 : Info: [tls] eaptls_verify returned 3 Wed Jun 2 20:29:14 2010 : Info: [tls] eaptls_process returned 3 Wed Jun 2 20:29:14 2010 : Info: [tls] Adding user data to cached session Wed Jun 2 20:29:14 2010 : Info: [tls] Saving response in the cache Wed Jun 2 20:29:14 2010 : Info: [tls] WARNING: No information to cache: session caching will be disabled for this session. If the reconnect takes place, the missing cache-data seems to be the problem -> the user cannot be authenticated: rad_recv: Access-Request packet from host 192.168.1.9 port 2048, id=55, length=237 User-Name = "myuser@mydom" NAS-Port = 0 Called-Station-Id = "00-25-...:mywlan" Calling-Station-Id = "00-13-..." Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = ...df1e94bea7671e5b6cf4571cf262db282b055d78ab191a3 State = 0x01880c0103840161cd60973c24894f7d Message-Authenticator = 0xf8b7771a372c0768720c9bf05de8708b Wed Jun 2 20:39:18 2010 : Info: +- entering group authorize {...} Wed Jun 2 20:39:18 2010 : Info: ++[preprocess] returns ok Wed Jun 2 20:39:18 2010 : Info: ++[chap] returns noop Wed Jun 2 20:39:18 2010 : Info: ++[mschap] returns noop Wed Jun 2 20:39:18 2010 : Info: [suffix] Looking up realm "mydom" for User-Name = "myuser@mydom" Wed Jun 2 20:39:18 2010 : Info: [suffix] No such realm "mydom" Wed Jun 2 20:39:18 2010 : Info: ++[suffix] returns noop Wed Jun 2 20:39:18 2010 : Info: [eap] EAP packet type response id 12 length 65 Wed Jun 2 20:39:18 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Jun 2 20:39:18 2010 : Info: ++[eap] returns updated Wed Jun 2 20:39:18 2010 : Info: ++[unix] returns notfound Wed Jun 2 20:39:18 2010 : Info: [files] users: Matched entry myuser@mydom at line 203 Wed Jun 2 20:39:18 2010 : Info: ++[files] returns ok Wed Jun 2 20:39:18 2010 : Info: ++[expiration] returns noop Wed Jun 2 20:39:18 2010 : Info: ++[logintime] returns noop Wed Jun 2 20:39:18 2010 : Info: ++[pap] returns noop Wed Jun 2 20:39:18 2010 : Info: Found Auth-Type = EAP Wed Jun 2 20:39:18 2010 : Info: +- entering group authenticate {...} Wed Jun 2 20:39:18 2010 : Info: [eap] Request found, released from the list Wed Jun 2 20:39:18 2010 : Info: [eap] EAP/tls Wed Jun 2 20:39:18 2010 : Info: [eap] processing type tls Wed Jun 2 20:39:18 2010 : Info: [tls] Authenticate Wed Jun 2 20:39:18 2010 : Info: [tls] processing EAP-TLS Wed Jun 2 20:39:18 2010 : Info: [tls] eaptls_verify returned 7 Wed Jun 2 20:39:18 2010 : Info: [tls] Done initial handshake Wed Jun 2 20:39:18 2010 : Info: [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Wed Jun 2 20:39:18 2010 : Info: [tls] <<< TLS 1.0 Handshake [length 0010], Finished Wed Jun 2 20:39:18 2010 : Info: [tls] TLS_accept: SSLv3 read finished A Wed Jun 2 20:39:18 2010 : Info: [tls] (other): SSL negotiation finished successfully Wed Jun 2 20:39:18 2010 : Debug: SSL Connection Established Wed Jun 2 20:39:18 2010 : Debug: SSL Application Data Wed Jun 2 20:39:18 2010 : Info: [tls] eaptls_process returned 3 Wed Jun 2 20:39:18 2010 : Info: [tls] Retrieved session data from cached session Wed Jun 2 20:39:18 2010 : Info: [tls] WARNING: No information in cached session! Wed Jun 2 20:39:18 2010 : Info: [eap] Freeing handler Wed Jun 2 20:39:18 2010 : Info: ++[eap] returns reject Wed Jun 2 20:39:18 2010 : Info: Failed to authenticate the user. Wed Jun 2 20:39:18 2010 : Auth: Login incorrect: [myuser@mydom] (from client WAP610N port 0 cli 00-13-...) Wed Jun 2 20:39:18 2010 : Info: Using Post-Auth-Type Reject Wed Jun 2 20:39:18 2010 : Info: +- entering group REJECT {...} Wed Jun 2 20:39:18 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> myuser@mydom Wed Jun 2 20:39:18 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Jun 2 20:39:18 2010 : Info: ++[attr_filter.access_reject] returns updated Wed Jun 2 20:39:18 2010 : Info: Delaying reject of request 13 for 1 seconds Wed Jun 2 20:39:18 2010 : Debug: Going to the next request Wed Jun 2 20:39:18 2010 : Debug: Waking up in 0.9 seconds. Wed Jun 2 20:39:19 2010 : Info: Sending delayed reject for request 13 Sending Access-Reject of id 55 to 192.168.1.9 port 2048 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 Independently of this incorrect login. the connection between the supplicant and the AP isn't disconnected or interrupted(!!), but the reauthentication is done every minute now. If the cache in eap.conf is disabled, the user can't be authenticated too, but the error during reauthentication is another (SSL_GET_PREV_SESSION:session id context uninitialized): rad_recv: Access-Request packet from host 192.168.1.9 port 2048, id=77, length=1484 User-Name = "myuser@mydom" NAS-Port = 0 Called-Station-Id = "00-25-...:mywlan" Calling-Station-Id = "00-13-...." Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = ...0170018001900230420447af7318cf8a9 EAP-Message = ...a3900200a0967a31318e54f7028eb6869963739a506ba EAP-Message = ...a35e57c17bbc86639826ba135d40271a953ec8fc6b1748 EAP-Message = ...ffe48b048b34ca5e97417950e1963592be7aa223ef906e8 EAP-Message = ...5647e8913e37299de4c889576a3cc2ac565285a27750f EAP-Message = ...5cccfedd1b96f38c9897681d78bbf75296a5e559e31c59b State = 0xaeafb685afa4bb3f1df61345a8211214 Message-Authenticator = 0xef86f802b12b474972c47fcd3692ae4f Wed Jun 2 21:04:16 2010 : Info: +- entering group authorize {...} Wed Jun 2 21:04:16 2010 : Info: ++[preprocess] returns ok Wed Jun 2 21:04:16 2010 : Info: ++[chap] returns noop Wed Jun 2 21:04:16 2010 : Info: ++[mschap] returns noop Wed Jun 2 21:04:16 2010 : Info: [suffix] Looking up realm "mydom" for User-Name = "myuser@mydom" Wed Jun 2 21:04:16 2010 : Info: [suffix] No such realm "mydom" Wed Jun 2 21:04:16 2010 : Info: ++[suffix] returns noop Wed Jun 2 21:04:16 2010 : Info: [eap] EAP packet type response id 11 length 253 Wed Jun 2 21:04:16 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Jun 2 21:04:16 2010 : Info: ++[eap] returns updated Wed Jun 2 21:04:16 2010 : Info: ++[unix] returns notfound Wed Jun 2 21:04:16 2010 : Info: [files] users: Matched entry myuser@mydom at line 203 Wed Jun 2 21:04:16 2010 : Info: ++[files] returns ok Wed Jun 2 21:04:16 2010 : Info: ++[expiration] returns noop Wed Jun 2 21:04:16 2010 : Info: ++[logintime] returns noop Wed Jun 2 21:04:16 2010 : Info: ++[pap] returns noop Wed Jun 2 21:04:16 2010 : Info: Found Auth-Type = EAP Wed Jun 2 21:04:16 2010 : Info: +- entering group authenticate {...} Wed Jun 2 21:04:16 2010 : Info: [eap] Request found, released from the list Wed Jun 2 21:04:16 2010 : Info: [eap] EAP/tls Wed Jun 2 21:04:16 2010 : Info: [eap] processing type tls Wed Jun 2 21:04:16 2010 : Info: [tls] Authenticate Wed Jun 2 21:04:16 2010 : Info: [tls] processing EAP-TLS Wed Jun 2 21:04:16 2010 : Info: [tls] eaptls_verify returned 7 Wed Jun 2 21:04:16 2010 : Info: [tls] Done initial handshake Wed Jun 2 21:04:16 2010 : Info: [tls] (other): before/accept initialization Wed Jun 2 21:04:16 2010 : Info: [tls] TLS_accept: before/accept initialization Wed Jun 2 21:04:16 2010 : Info: [tls] <<< TLS 1.0 Handshake [length 050b], ClientHello Wed Jun 2 21:04:16 2010 : Error: TLS_accept:error in SSLv3 read client hello C Wed Jun 2 21:04:16 2010 : Error: rlm_eap: SSL error error:140D9115:SSL routines:SSL_GET_PREV_SESSION:session id context uninitialized Wed Jun 2 21:04:16 2010 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Wed Jun 2 21:04:16 2010 : Debug: TLS receive handshake failed during operation If fast_reauth in wpa_supplicant is disabled, the reauthentication works fine, but the connection between the AP and the supplicant ist interrupted for about 20 seconds - much to long :-). Do you have any idea how to solve this problem? Thanks for you help, Andreas

5 30

Username manipulation
by Greg Malewski 07 Jun '10

07 Jun '10

Hi, I have been unable to find any examples - if the facility exists - of being able to process a username prior to forwarding it. For example, I may wish to take a username such as joe_bloggs and convert it into joe.bloggs prior to passing it on to the authentication oracle. Furthermore, is it possible to only do this with some RADIUS clients? Thanks in advance Greg

2 1

OCSP support
by Nikita Koshikov 07 Jun '10

07 Jun '10

Hello list, Is freeradius able to validate certificates using OCSP protocol for EAP-TLS clients ? If yes - where can I find relevant config example?

2 1

Accounting to MySQL not working
by Christoph Schwabl 07 Jun '10

07 Jun '10

Hello, I have a small problem with accounting to mysql. freeradius 2.1.8 mysql Ver 14.12 Distrib 5.0.51a, for debian-linux-gnu (i486) using readline 5.2 The NAS is sending accounting data, which I can see in: more /var/log/freeradius/radacct/192.168.1.10/detail-20100526 ... Wed May 26 23:43:57 2010 Acct-Session-Id = "00000039" Called-Station-Id = "0011.2177.0da4" Calling-Station-Id = "001f.3b1c.f25b" Cisco-AVPair = "ssid=testradius" Cisco-AVPair = "vlan-id=0" Cisco-AVPair = "nas-location=unspecified" User-Name = "testuser" Cisco-AVPair = "connect-progress=Call Up" Acct-Session-Time = 237 Acct-Input-Octets = 35971 Acct-Output-Octets = 64059 Acct-Input-Packets = 473 Acct-Output-Packets = 98 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "296" NAS-Port = 296 Service-Type = Framed-User NAS-IP-Address = 192.168.1.10 Acct-Delay-Time = 0 Acct-Unique-Session-Id = "4d69927723cb56d8" Timestamp = 1274910237 Request-Authenticator = Verified But I cann't find accounting data in MySQL database. My configuration is: radiusd.conf ================== ... $INCLUDE sql.conf ... readclients = yes ... sites-enabled/inner-tunnel ================== ... authorize { chap mschap unix suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files sql expiration logintime pap } ... sites-enabled/default ================== ... authorize { preprocess chap mschap suffix eap { ok = return } unix files sql expiration logintime pap } ... accounting { detail unix radutmp sql attr_filter.accounting_response } ... Using users (radcheck) and clients (nas) from MySQL are working well. However, accounting into MySQL is not working. Anybody an idea? thx & br Christoph -- GMX.at - Österreichs FreeMail-Dienst mit über 2 Mio Mitgliedern E-Mail, SMS & mehr! Kostenlos: http://portal.gmx.net/de/go/atfreemail

6 14