- Freeradius-Users - lists.freeradius.org

[Suppress Attribute in Access Accept]
by Thomas Fagart 28 Jan '10

28 Jan '10

Hello, I would like to be able to

2 2

Found2 Auth-Type on request
by Tevfik Ceydeliler 28 Jan '10

28 Jan '10

Hi list, My test connection shows a warning about auth types. Why this error occurs? And how can I fix it? I wonder which configuration files decide that auth type is Accept? Here is log part: rad_recv: Access-Request packet from host 172.30.80.1 port 1806, id=182, length=133 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 158434808 CHAP-Challenge = 0x665272f56e2480247ac4d7582653a4bd User-Name = "saradinmez" CHAP-Password = 0x012e7599f6a8bfb90c0591fa75fbe19909 Calling-Station-Id = "905308507313" +- entering group authorize {...} expand: %{User-Name} -> saradinmez [preprocess] hints: Matched DEFAULT at 78 expand: %{User-Name}@otp -> saradinmez@otp ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] Looking up realm "otp" for User-Name = "saradinmez@otp" [suffix] Found realm "otp" [suffix] Adding Stripped-User-Name = "saradinmez" [suffix] Adding Realm = "otp" [suffix] Proxying request from user saradinmez to realm otp [suffix] Preparing to proxy authentication request to realm "otp" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry saradinmez at line 216 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 27 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 158434808 CHAP-Challenge = 0x665272f56e2480247ac4d7582653a4bd User-Name := "saradinmez" CHAP-Password = 0x012e7599f6a8bfb90c0591fa75fbe19909 Calling-Station-Id = "905308507313" Proxy-State = 0x313832 Proxying request 0 to home server 10.1.1.51 port 1812 Sending Access-Request of id 27 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 158434808 CHAP-Challenge = 0x665272f56e2480247ac4d7582653a4bd User-Name := "saradinmez" CHAP-Password = 0x012e7599f6a8bfb90c0591fa75fbe19909 Calling-Station-Id = "905308507313" Proxy-State = 0x313832 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=27, length=25 Proxy-State = 0x313832 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop ++[files] returns noop Found Auth-Type = CHAP Found Auth-Type = Accept Warning: Found 2 auth-types on request for user 'saradinmez' !!!!!!!!!!! HERE IS THE PROBLEM I THINK !!!!!!!!!!!!! Auth-Type = Accept, accepting the user +- entering group post-auth {...} Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

ldap redundancy & Ldap-Group checkItem in user file
by Fred 28 Jan '10

28 Jan '10

ldap redundancy & Ldap-Group checkItem in user file Hi all, I try to migrate a freeradius 1 (where ldap failover was not working) to freeradius 2 and I have some difficulties to configure LDAP failover : As Ldap-Group is registered with individual ldap instances name, (ei ldap1-Ldap-Group & ldap2.Ldap-Group), it seems to be necessary to reference ldap servers twice in users file checkItems : ldap1-Ldap-Group == xyz ldap2-Ldap-Group == xyz ..... I don't see how to make freeradius register to somethink like ldapRedundant. Is there any way to do that ? Despite those attributes are instanciated, I can't have them checked in file users Ldap-Group were checked previously via files, users and huntgroups like this : # users : DEFAULT Huntgroup-Name == ras, NAS-Port-Type == Virtual , Ldap-Group == ras, User-Profile := "uid=ras,ou=profiles,ou=radius,dc=mydomain,dc=local" Fall-Through = no DEFAULT Huntgroup-Name == ras, Service-Type == Login , Ldap-Group == ras, User-Profile := "uid=login,ou=profiles,ou=radius,dc=mydomain,dc=local" Fall-Through = no # huntgroups ras NAS-IP-Address == 10.1.1.1 login NAS-IP-Address == 10.1.1.1 ras NAS-IP-Address == 10.1.2.1 login NAS-IP-Address == 10.1.2.1 ras NAS-IP-Address == 10.1.3.1 login NAS-IP-Address == 10.1.3.1 freeradius -X FreeRADIUS Version 2.1.8 ...... rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap1-Ldap-Group ...... rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap2-Ldap-Group .... Best regards, Fred MAISON

2 1

Using the same FreeRadius for account into MySQL for clients whith different attributes
by David Florella 28 Jan '10

28 Jan '10

Hi, I am using a FreeRadius server Version 1.0.1 only for accounting with Cisco gateways. Now, I want to use the same server with Dialogic gateways. Dialogic and Cisco have their own RADIUS dictionary. When I write in a MySQL database the log of accounting, how can I write for both attributes (Cisco and Dialogic)? Regards, David.

2 1

Framed-IP-Address cant override NAS ip pool
by Tevfik Ceydeliler 28 Jan '10

28 Jan '10

Hi list, Still I try to assign statci Ip for my users. And still I can't achive. I try to use all ways . Now I try to assign particularIP to my users from pool. But it is not satisfied. I read some mail and modify suggested confiuration according to my tolopogy. Do I have to add some additional configuration? P.S. SecOvid is Kobil SecOvid OTP server which IP address is 10.1.1.51, 10.1.2.123 Freeradius Server, 10.65.8.100 ismy laptop with NTRadPing ##Users conf: Tevfikceydeliler Proxy-To-Realm := SecOvid, Pool-Name := "STATICPOOL" Service-Type := Framed-User, Framed-Protocol == PPP, Framed-MTU = 576, Framed-IP-Address = 172.16.64.120, -----> IP Address that I want Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP ##ippool conf: ippool STATICPOOL { range-start = 172.30.64.100 range-stop = 172.30.64.150 netmask = 255.255.240.0 cache-size = 51 session-db = ${db_dir}/db.ippool_static ip-index = ${db_dir}/db.ipindex_static override = no maximum-timeout = 0 } ##Freeradius -X output: rad_recv: Access-Request packet from host 10.65.8.100 port 64616, id=15, length=56 User-Name = "tevfikceydeliler" User-Password = "172925283501" --->produce by OTP +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100122 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100122 expand: %t -> Fri Jan 22 21:12:00 2010 ++[detail] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry tevfikceydeliler at line 102 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop +- entering group pre-proxy {...} ++[files] returns noop expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100122 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100122 expand: %t -> Fri Jan 22 21:12:00 2010 ++[detail] returns ok Sending Access-Request of id 22 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172925283501" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x3135 Proxying request 0 to home server 10.1.1.51 port 1812 Sending Access-Request of id 22 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172925283501" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x3135 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=22, length=24 Proxy-State = 0x3135 +- entering group post-proxy {...} expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100122 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100122 expand: %t -> Fri Jan 22 21:12:00 2010 ++[detail] returns ok [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} ++[TESTPOOL] returns noop expand: %{NAS-IP-Address} %{NAS-Port} -> 10.65.8.100 [STATICPOOL] MD5 on 'key' directive maps to: b6201c0efddb958ed955eb3c8b0d920a [STATICPOOL] Searching for an entry for key: 'b6201c0efddb958ed955eb3c8b0d920a' rlm_ippool: Allocating ip to key: 'b6201c0efddb958ed955eb3c8b0d920a' [STATICPOOL] num: 1 [STATICPOOL] Allocated ip 172.30.64.144 to client key: b6201c0efddb958ed955eb3c8b0d920a ++[STATICPOOL] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100122 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100122 expand: %t -> Fri Jan 22 21:12:00 2010 ++[detail] returns ok ++[exec] returns noop Sending Access-Accept of id 15 to 10.65.8.100 port 64616 Framed-IP-Address = 172.30.64.144 ----------->>From pool but not that I want. Framed-IP-Netmask = 255.255.240.0 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 15 with timestamp +25 Ready to process requests. ##radsniff output: Packet number 1 has just been sniffed From: 10.65.8.100:64616 To: 10.1.2.123:1812 Type: Access-Request User-Name = "tevfikceydeliler" User-Password = "172925283501" Packet number 2 has just been sniffed From: 10.1.2.123:1814 To: 10.1.1.51:1812 Type: Access-Request User-Name = "tevfikceydeliler" User-Password = "pm_\366%\203\177\003\222\201M-9\267\010'" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x3135 Packet number 3 has just been sniffed From: 10.1.1.51:1812 To: 10.1.2.123:1814 Type: Access-Accept Proxy-State = 0x3135 Packet number 4 has just been sniffed From: 10.1.2.123:1812 To: 10.65.8.100:64616 Type: Access-Accept Framed-IP-Address = 172.30.64.144 Framed-IP-Netmask = 255.255.240.0 Best Ragards. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

Duplicating results for radtest
by Mark Smith 28 Jan '10

28 Jan '10

I have a Centos 5.3 server running the latest version of FreeRadius. I have 15 routers that need to be authenticated on an ADSL network. I am experiencing duplicate results for a radtest on my Freeradius server. I need to send multiple Cisco-AVPair values for a user login. I read on the Wiki that I should use the += operator to do this. The RadReply table is as follows: id Username Attribute Op Value 1 test(a)test.net Framed-Protocol := PPP 2 test(a)test.net Framed-IP-Netmask := 255.255.255.0 3 test(a)test.net Framed-IP-Address := 176.25.165.1 4 test(a)test.net Cisco-AVPair := ip:route=176.25.165.0 255.255.255.0 176.25.165.1 5 test(a)test.net Cisco-AVPair += ip:route=0.0.0.0 0.0.0.0 #.#.#.# 6 test(a)test.net Cisco-AVPair += ip:dns-servers=#.#.#.# #.#.#.# The results get back are Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 176.25.165.1 Cisco-AVPair = ip:route=176.25.165.0 255.255.255.0 176.25.165.1 Cisco-AVPair = ip:route=0.0.0.0 0.0.0.0 #.#.#.# Cisco-AVPair = ip:dns-servers=#.#.#.# #.#.#.# Cisco-AVPair = ip:route=0.0.0.0 0.0.0.0 #.#.#.# Cisco-AVPair = ip:dns-servers=#.#.#.# #.#.#.# As you can see, the last two Cisco-AVPair lines, that have the attribute of '+=', appear twice in the returned values. If I change the operator to anything else e.g. ':=' or '=' I don't get a reply for them at all when doing a radtest. Does anyone know why this is happening and does it matter that it is happening? Mark Smith Systems Engineer Abel Alarm Co Ltd

4 6

FreeRADIUS Dictionary attribute types
by Ben Wiechman 28 Jan '10

28 Jan '10

Is the integer type in the dictionaries signed or unsigned? It appears from the release notes for 2.1.8 that it is, but this is not noted in the dictionary file that I have seen so would like to confirm. Ben

2 1

freeradius -X debug mode
by Sylvain De Muynck 28 Jan '10

28 Jan '10

Dear all, I would like to know if there is a way to get the content of the debug mode through another tool. In fact, that could be interesting for me since I am doing a migration process and I do not know all passwords of my customer. In other work, I would like to see, when my Radius send an access-reject packet what was the attribute sent by my customer equipment. This is written on the debug mode however, I hqve around 300 customers so I will not stop the Radius just to check this. Is there also maybe a way of running debug mode over the daemon, meaning you do not have to stop it? I was thinking about Ethereal or this kind of sofware to sniff the incoming packet. Thanks in advance for your reply. My configuration: Radius v.2 OS : Debian NAS : Alvarion Users equipment : Alvarion CPE Regards Sylvain

2 1

EAP-TLS - OpenLDAP - UID Check
by _Stefan_H 27 Jan '10

27 Jan '10

Hello, due to a typing error i realized that there is a mistake at my configuration, the eap-tls is working fine but it doesn't matter what name is written in the certificate, ldap is returning not found but the user is always accepted. I looked at the ldap module for an identity check but i can't find it and setting access_attr = "uid" makes no difference. Please give me a hint where i have to look. -- View this message in context: http://old.nabble.com/EAP-TLS---OpenLDAP---UID-Check-tp27326455p27326455.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Freeradius + MySQL + Encrypted Password
by Juliano Faoro 27 Jan '10

27 Jan '10

Hi, I've just installed a freeradius with mysql and it is working OK with text passwords on the radcheck table. When I try using MD5 password it doesn't work. Does anyone have a "radius.conf" template file that I can use as a reference and also how the tables on mysql should be populated. I already went through hundreds of messages on this mailing list, searched on wiki, google, etc.. but couldn't get it working so I thought that would be easier if I started it fresh with a simple working configuration. The versions that I am running are: -freeradius-mysql-1.1.3-1.2.el5 -freeradius-1.1.3-1.2.el5 -mysql-server-5.0.77-4.el5_4.1 Thanks for any help. Cheers, Juliano

3 2