- Freeradius-Users - lists.freeradius.org

strange accounting update
by Good One 07 Jun '10

07 Jun '10

I am observing that some of the user’s sessions are accounting a wrong update which is very strange. The send/receive byte updated value for such sessions is always 4294967296 KB (4096GB). So if you aggregate both in/out it is 4096+4096 for a single session. It's really very strange why radius accouting is being updated with the same value for certain users on periodic interval. Any comments/thoughts will be appreciated. Thanks Andrew _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1

Re: Freeradius is unable to read NAS table in mysql db
by superataru - 07 Jun '10

07 Jun '10

Hi. Thank you for reply. I thought same thing could be possible, so i created an other user on mysql server. I connected directly to USG on the Public IP of its (no VPNs now) I performed radiusd -X . . . .... User-Name = "vito" User-Password = "catozzo" NAS-IP-Address = 172.16.68.10 NAS-Identifier = "weblogin" NAS-Port = 24081 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "78.aa.bb.148" *<- this is my current IP address at home* .... My Daloradius NAS reports the two NAS, addresses of WAN2* and WAN1** of USG in HQ LAN1 of USG is 172.16.68.253. Server WIn2003 has 172.16.68.10. Has a Radius on, but users are created by a VB client i developed some yrs ago, with only numers and dots on both username and password for eache user. No way to have vito/catozzo on :-) ID NAS NAS IP/Host Diminutivo NAS Tipo NAS Porte NAS NAS Secret Descrizione NAS 3 89.aa.bb.cc o-fw* other 0 myshared 6 79.dd.ee.ff o-tvc** other 0 myshared

2 1

RE: Freeradius is unable to read NAS table in mysql db
by superataru - 07 Jun '10

07 Jun '10

Hi. Sorry for some errors in former mails. "Yes" parameter is the right one. Once i set this i obtain what i want: it works! I had misunderstood what parameter yes/no would have changed on setting. I already attach log file with *yes* setting. *So problem has been solved! :-)* Anyway . . . I see something strange in part of it: *address 172.16.68.10* I explain my configuration: a. remote NAS USG100 with publicIP 89.aa.bb.cc. LAN IP is 172.16.68.253 gateway for 172.16.68.0/24 network. it holds iformations about all AAA servers. b. my freeradius (with mysql) is behind a router (public IP 79.ss.dd.ss) that forwards 1812/1813 UDP to WAN Iface of my Fedora Server. Now . . . *172.16.68.10 is* the IP address of a Win2003 Server with WinRadius (MS Access DB) on. 172.16.68.16 is client i reach via SSL tunnel. From this one i, thru WEBLogIN (useraware of USG100), i provide username/password stored in my mysql server and authentication goes fine with freeradius. Why does it reports informations about other AAA servers? Is it an error of USG? Thanks in advance! Little abstracts about radiusd -x Setting . ... *readclients = yes* in /usr/local/etc/raddb/sql.conf, running #radiusd -X User-Name = "cactus" User-Password = "barilotto" NAS-IP-Address = 172.16.68.10 NAS-Identifier = "weblogin" NAS-Port = 15330 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "172.16.68.16"

2 1

Freeradius is unable to read NAS table in mysql db
by superataru - 07 Jun '10

07 Jun '10

Hi all. I'm pretty new with Freeradius, but it seems matching my targets :-) I set Freeradius with mysql server and Daloradius Management. After some troubles to install FR, it worked fine, at least as basical startup: i can authenticate remote users! For real it works if i use /raddb/clients.conf file, setting readclients = yes in /raddb/sql.conf. Once i set it to "no", autentication fails. I checked nas table structure and it's ok, the same as in /usr/local/etc/raddb/sql/mysql/nas.sql User are instead loaded fine from mysql users table. How could i solve it? Thanks in advance Here my configuration. Fedora Core 10 Freeradius 2.1.9 Daloradius 0.9-7 MySQL 5.0.88 Remote NAS: ZyXEL USG100 (2.21) Superataru --

3 5

little sql help required
by Strong, Mark 07 Jun '10

07 Jun '10

All, I've read the SQL_HOWTO, and have it working, however I'm trying to understand this bit in the example. group { sql1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } sql2 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } } I've got two servers, each with its own mysql db (replicated to each other), and I'd like freeradius to fail over to the other boxes mysql server if its local one dies. So I'd like to understand what that group mysql example does, before I paste it into my configs. Looked at the docs, but can't find it (or something like it) described anywhere. I've got version 2.1.6, on Centos 4.7 Regards Mark Strong

2 2

RE: Freeradius is unable to read NAS table in mysql db
by superataru - 06 Jun '10

06 Jun '10

Thank you for reply. I found the problem. I missed a field during nas table analysis. The field was "server, varchar(64). I added it. I had also to - clear clients.conf from NAS manually added to avoid duplicates; - set one NAS address, formerly added, as Host address instead of subnet. Now it works fine! Now backup of configuration and going to work on chiphering passwords and manage WiFi. Superataru. reply to . . "Your message doesn't have enough information to troubleshoot your problem. Run FreeRADIUS in debug mode (radiusd -X) and read the error messages. If you still can't solve your problem, send the debug output to the mailing list. Tim"

1 0

backup of external proxy
by Fred MAISON 06 Jun '10

06 Jun '10

Hello, When proxing some eap-type by real to an external radius, is it possible to configure a normal and a backup proxy server ? I saw (in proxy.conf comments) it was possible when proxying to a local virtual server, but I don't understand what to do for normal/backup externals radius we have to proxy to for a particular real. Best regards, Fred MAISON

2 1

username and attributes
by rosect190＠yahoo.com 06 Jun '10

06 Jun '10

I have two users (u1 and u2) and want to use PEAP to auth them. For each user, I will return an attribute. For example, attr1 for u1 and attr2 for u2. An interesting thing is that, when my out-tunnel user name is "anonymous", I do not see any attribute be returned although the auth is successful. Further testing shows, if I use user2's name (u2) as user1's out-tunnel name and use user1's name (u1) as user2's out-tunnel name, user1 will receive attri2 and user2 will receive attr1. It seems that the server picks attributes based on the out-tunnel name, not the real user name. In file /etc/raddb/users, I configure users as follows: u1 Cleartext-Password := "p1" Service-Type = 6 u2 Cleartext-Password := "p2" Service-Type = 4 I do not understand why. Is there anything I did not configure in the server? Thank you very much for any suggestion!

2 1

Freeradius problem, EAP-TTLS works fine, EAP-PEAP does not
by David 05 Jun '10

05 Jun '10

Hello all, my fraternity has been using freeradius for quite some time. However, there were two problems: the default certificate was used and EAP-PEAP MSCHAPv2 doesn't work, only EAP-TTLS PAP. This requires users to install a supplicant (we recommend SecureW2). We would also enable users to use EAP-PEAP MSCHAPv2 since that is supported by Windows XP and up by default. I've cleared the first problem, and I can now connect while validating the certificate using EAP-TTLS PAP. EAP-PEAP still doesn't work however. Windows asks for username + password, then again, then fails. I've configured the module to the best of my knowlegde. When connecting with Window 7 the following gets written to radius.log: Sat Jun 5 00:00:59 2010 : Info: rlm_eap_md5: Issuing Challenge Sat Jun 5 00:00:59 2010 : Info: rlm_eap_mschapv2: Issuing Challenge As opposed to EAP-TTLS, then the following gets written: Sat Jun 5 00:03:23 2010 : Info: rlm_eap_md5: Issuing Challenge Here are the relevant config sections for eap.conf: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } and from radiusd.conf: mschap { # I saw this in the default configuration on a site, but in the documentation it was listed that the server can figure this out for itself. Is it needed? #authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Nam$ } As far as I know authentication is performed against local users. (every user can login through SSH if he wanted). Samba is also installed (and heavily used) but I could not find a /etc/smbpasswd so I guess it also authenticates against local users. Does anyone know where the problem may be? I cannot think of anything to try anymore. Thanks in advance, David

2 1

Freeradius problem, EAP-TTLS works fine, EAP-PEAP does not
by David Hoepelman 05 Jun '10

05 Jun '10

Hello all, my fraternity has been using freeradius for quite some time. However, there were two problems: the default certificate was used and EAP-PEAP MSCHAPv2 doesn't work, only EAP-TTLS PAP. This requires users to install a supplicant (we recommend SecureW2). We would also enable users to use EAP-PEAP MSCHAPv2 since that is supported by Windows XP and up by default. I've cleared the first problem, and I can now connect while validating the certificate using EAP-TTLS PAP. EAP-PEAP still doesn't work however. Windows asks for username + password, then again, then fails. I've configured the module to the best of my knowledge. When connecting with Window 7 the following gets written to radius.log: Sat Jun 5 00:00:59 2010 : Info: rlm_eap_md5: Issuing Challenge Sat Jun 5 00:00:59 2010 : Info: rlm_eap_mschapv2: Issuing Challenge As opposed to EAP-TTLS, then the following gets written: Sat Jun 5 00:03:23 2010 : Info: rlm_eap_md5: Issuing Challenge Here are the relevant config sections for eap.conf: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } and from radiusd.conf: mschap { # I saw this in the default configuration on a site, but in the documentation it was listed that the server can figure this out for itself. Is it needed? #authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User- Nam$ } As far as I know authentication is performed against local users. (every user can login through SSH if he wanted). Samba is also installed (and heavily used) but I could not find a /etc/smbpasswd so I guess it also authenticates against local users. Does anyone know where the problem may be? I cannot think of anything to try anymore. Thanks in advance, David

1 0