- Freeradius-Users - lists.freeradius.org

Can't Assign IP address my users
by Tevfik Ceydeliler 25 Jan '10

25 Jan '10

Hi Alain, > Also, the proxy isn't returning an IP address: >> Wed Jan 20 10:01:07 2010 : Info: [main_pool] Could not find Pool-Name attribute. >> Wed Jan 20 10:01:07 2010 : Info: ++[main_pool] returns noop That log is taken from test for static IP Here is the log for user who get IP address from pool : rad_recv: Access-Request packet from host 10.65.8.100 port 65401, id=2, length=56 User-Name = "tevfikceydeliler" User-Password = "172932808506" +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry tevfikceydeliler at line 216 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop +- entering group pre-proxy {...} expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok Sending Access-Request of id 236 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172932808506" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x32 Proxying request 1 to home server 10.1.1.51 port 1812 Sending Access-Request of id 236 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172932808506" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x32 Going to the next request Waking up in 0.9 seconds. OK ############################> rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=236, length=23 Proxy-State = 0x32 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} OK ############################>++[main_pool] returns noop expand: %{NAS-IP-Address} %{NAS-Port} -> 10.65.8.100 OK ############################>[birmas] MD5 on 'key' directive maps to: b6201c0efddb958ed955eb3c8b0d920a [birmas] Searching for an entry for key: 'b6201c0efddb958ed955eb3c8b0d920a' [birmas] Found a stale entry for ip: 172.30.64.95 [birmas] num: 0 rlm_ippool: Allocating ip to key: 'b6201c0efddb958ed955eb3c8b0d920a' [birmas] num: 1 [birmas] Allocated ip 172.30.64.86 to client key: b6201c0efddb958ed955eb3c8b0d920a ++[birmas] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok ++[exec] returns noop OK ############################>Sending Access-Accept of id 2 to 10.65.8.100 port 65401 OK ############################> Framed-IP-Address = 172.30.64.86 OK ############################> Framed-IP-Netmask = 255.255.240.0 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 2 with timestamp +44 Ready to process requests. There is no manual about how to set user for static ip address. Mostly configurations use password. But i use OTP (realm) as password. What is changed when user moved from pool so static ip? Tevfik Ceydeliler Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

Conditional expression ":-" deprecated?
by John Morrissey 24 Jan '10

24 Jan '10

We have a vendor product that only supports usernames shorter than 64 characters. I used the unlang expression: if ("%{#User-Name:-0}" <= 63) to avoid sending accounting with longer usernames to it, which yielded: server buffered-dpi-esc4 { +- entering group preacct {...} ++? if ("%{#User-Name:-0}" <= 63) WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{#User-Name:-0} -> 70 ? Evaluating ("%{#User-Name:-0}" <= 63) -> FALSE ++? if ("%{#User-Name:-0}" <= 63) -> FALSE I got the ":-" expression from unlang(5), which doesn't mention that it's deprecated. I used this expression to specify a default length of 0 since unlang(5) states that %{#attr} returns an empty value if attr isn't present, and I wasn't sure how FreeRADIUS would react to a numeric comparison against an unset value. I'm using: if (User-Name && "%{#User-Name}" <= 63) { instead for now, but is the ":-" expression really deprecated, and is there an alternative equivalent? How will FreeRADIUS react to an unset value in a numeric comparison? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

4 7

Duplicate Radius data when OSPF Kicks in
by Eugene van der Merwe 24 Jan '10

24 Jan '10

Hi, We have a problem with duplicate sessions on our MikroTik wireless network with FreeRADIUS when OSPF kicks in: Subscription Analysis for user@isp 2010-01-17 up to 2010-01-25 # logged in session time upload download server terminate cause callerid 1 2010-01-23 22:07:31 15 hours 6.9 MB 83.6 MB * 192.168.199.254*:513 - 00:0B:6B:DB:A9:96 2 2010-01-22 22:07:30 18 hours 16.2 MB 451.1 MB * 192.168.208.1*:434 - 00:0B:6B:DB:A9:96 3 2010-01-22 22:07:29 1 days 27.0 MB 0.6 GB 192.168.199.254:434 Session-Timeout 00:0B:6B:DB:A9:96 4 2010-01-21 22:07:27 1 days 4.7 MB 65.0 MB 192.168.199.254:386 Session-Timeout 00:0B:6B:DB:A9:96 5 2010-01-20 22:07:25 1 days 2.9 MB 45.7 MB 192.168.199.254:331 Session-Timeout 00:0B:6B:DB:A9:96 6 2010-01-19 22:07:23 2 hours 171.3 KB 1.4 MB 192.168.208.1:290 - 00:0B:6B:DB:A9:96 7 2010-01-19 22:07:23 1 days 2.9 MB 24.5 MB 192.168.199.254:290 Session-Timeout 00:0B:6B:DB:A9:96 8 2010-01-18 22:07:20 1 days, 1 seconds 3.8 MB 66.2 MB 192.168.199.254:207 Session-Timeout 00:0B:6B:DB:A9:96 9 2010-01-17 22:07:15 1 days 1.5 MB 10.0 MB 192.168.199.254:166 Session-Timeout 00:0B:6B:DB:A9:96 10 2010-01-17 22:07:15 0 seconds 0.0 KB 0.0 KB 192.168.208.1:166 - 00:0B:6B:DB:A9:96 High site 1 is 192.168.199.254 and high site 2 is 192.168.208.1. As you can see it looks like FreeRADIUS counts the extra data on the dropped connection as well. The only suggestion I have received so far is to use a product called SMRadius (http://www.smradius.org/tiki-index.php?page=Features) that apparently merges duplicate sessions. But my FreeRadius installation is 7 years old and I don't want to change to another product. We are using FreeRADIUS Version 1.1.7, for host x86_64-pc-linux-gnu (Ubuntu 8.04 64-bit). mysql Ver 14.12 Distrib 5.0.51a, for debian-linux-gnu (x86_64) using readline 5.2 Apart from that we have a pretty stock standard default installation. I have heard about some other people with large MikroTik networks and OSPF and FreeRADIUS that they are having the same problem. I have also described this problem on the MikroTik forum: http://forum.mikrotik.com/viewtopic.php?f=2&t=38620 please assist urgently, this problem is leading to some difficult client service inquiries. -------- Eugene van der Merwe

3 2

Removing an attribute from reply message!
by Hamid Reza Hasani 24 Jan '10

24 Jan '10

Hi, I want to remove an attribute from reply message(account accept), how can I should do that? more detail: I'm using some sqlcounter to count daily, weekly and monthly octets. After their processing they add Session-Octets-Limit to my reply message. I want to have a condition that if this value reach some special value (for example 20000Byte), then it removes Session-Octets-Limit from reply message. I add this lines at the end of authorize section: if("%{reply.Session-Octets-Limit}" >= 20000) { update reply { Session-Octets-Limit [I don't know what!] } } Is it correct? I don't know! am I should add a module or filter or else? BTW how can I remove Session-Octets-Limit from reply message! Is it possible? Thanks. Hamid Reza Hasani ------------------ Ya Ali

2 3

radiusd only starting with radiusd -X, but not as daemon via rc.freeradius
by Michael Arndt 23 Jan '10

23 Jan '10

hello *, 1. i can start radiusd with a valid and working radiusd.config using radiusd -X in this case auth using e.g radtest or other clients is working and stable .. 2. without the -X option and as a "service" via rc.freeradius radiusd will start, but authentication against radius is not sucessful, e.g. using radtest .... ( cannot connect to ... ) as far as i understand, difference between both modes is, that without -X radiusd switches over from root to "user" radius after parsing all config files. So i assume a problem with a socket or else, but with strace i see no hint that gives me a clue any hints in which direction my debugging should go ... ??? System is an openSUSE 10.3 (i586) VERSION = 10.3 SW Package Versions: freeradius-devel-1.1.6-47.4 freeradius-client-1.1.5-36 freeradius-1.1.6-47.4 freeradius-client-libs-1.1.5-36 freeradius-client-devel-1.1.5-36 pam_radius-1.3.16-144 TIA Michael

3 2

Blank Password Problem
by Satyam Mathura 23 Jan '10

23 Jan '10

Guys, I'm experiencing a strange problem. I use FreeRadius to control cmd line access to my routers and switches and I've configured FreeRadius to use a MySQL back-end and thus far it works fine except for one condition. If i supply a blank password when authenticating, FreeRadius allows the request and authenticates me once my username is correct. Why is this happening? Is there any way to have FreeRadius keep on prompting if a blank password is supplied or reject the request altogether? Thanks for your help. Radius debug is below: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 1645, id=215, length=104 User-Name = "john.doe" Reply-Message = "Password: " User-Password = "" NAS-Port = 1 NAS-Port-Id = "tty1" NAS-Port-Type = Virtual Calling-Station-Id = "192.168.1.1" NAS-IP-Address = 192.168.1.1 +- entering group authorize ++[preprocess] returns ok rlm_sql (sql): - sql_xlat expand: %{User-Name} -> john.doe rlm_sql (sql): sql_set_user escaped user --> 'john.doe' expand: SELECT groupname FROM radhuntgroup WHERE nasipaddress="%{NAS-IP-Address}" AND nasportid LIKE IF (SUBSTRING("%{NAS-Port-Id}", 1, 3) = 'tty', 'tty', "%{NAS-Port-Id}") AND usergroup IN (SELECT groupname FROM radusergroup where username LIKE "%{User-Name}") -> SELECT groupname FROM radhuntgroup WHERE nasipaddress="192.168.1.1" AND nasportid LIKE IF (SUBSTRING("tty1", 1, 3) = 'tty', 'tty', "tty1") AND usergroup IN (SELECT groupname FROM radusergroup where username LIKE "john.doe") rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 3 expand: %{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress="%{NAS-IP-Address}" AND nasportid LIKE IF (SUBSTRING("%{NAS-Port-Id}", 1, 3) = 'tty', 'tty', "%{NAS-Port-Id}") AND usergroup IN (SELECT groupname FROM radusergroup where username LIKE "%{User-Name}") } -> admin ++[request] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "john.doe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 204 ++[files] returns ok expand: %{User-Name} -> john.doe rlm_sql (sql): sql_set_user escaped user --> 'john.doe' rlm_sql (sql): Reserving sql socket id: 2 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john.doe' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'john.doe' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'john.doe' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'engineeringadmin' ORDER BY id rlm_sql (sql): User found in group engineeringadmin expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'engineeringadmin' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Normalizing SHA-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [john.doe] (from client routerA port 1 cli 192.168.1.1) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 215 to 192.168.1.1 port 1645 Service-Type := Administrative-User Cisco-AVPair := "shell:priv-lvl=15" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 215 with timestamp +9 Ready to process requests.

3 7

Session-timeout and expiration problem
by Fazal Ahmed Malik 22 Jan '10

22 Jan '10

Hi, I have installed Freeradius 2.0 along with mysql 5 and dialup_admin. I am having trouble with session-timeout ,expiration. On dialup_admin i have correct information for both attributes like user can login for 0 seconds and similarly for expiration like account expired. But users can still logon even after expiration date passed. For session timeout user get disconnected right after alocated quota but here again user can login. Both attribute are setup from dialupadmin with = operator for session timeout and := for expiration Please help if i am missing some thing in config. Best regards, Fazal Ahmed

2 1

IP delivery for any MAC addresses issues
by Sylvain De Muynck 22 Jan '10

22 Jan '10

Dear freeradius users, I am currently facing an issue on my network architecture. Before, I was using freeradius with a DHCP server running in order to attribute IPs addresses to my customers (I work for an ISP) This configuration is perfectly working however for security, maintenance and monitoring, I took the choice of delivering IP addresses through my radius server. In fact, our Base Station got 2 modes of working, one is Ethernet and the other is IP mode data, so I juste configured as IP mode data to get it working. WHAT IS THE PROBLEM : when I connect my computer it is perfectly working and I can get my IP and all network parameters to get an access to the Internet however, when I want to change of computer, it does not work anymore. We were thinking about record of the MAC address as a security level and would like to get to know more about it. The attributes we are using are : Framed-Netmask --> Netmask Filter-Id --> DNS in this attribute (that's vendor attribute Alvarion) Framed-route --> Routing to the gateway Framed-Ip-address --> the IP addresse If you don't know, could you please advice me on how to troubleshoot this issue. Thanks in advance for your help, Best regards Sylvain

1 0

new ntlm_auth?
by freeradius＠corwyn.net 21 Jan '10

21 Jan '10

Did the recent upgrade of freeradius2 add a ntlm_auth module? I'm now seeing Exec-Program output: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program: returned: 1 ++[ntlm_auth] returns reject Failed to authenticate the user. Login incorrect: [rsteeves] (from client 10.100.0.8 port 1 cli 10.20.31.17) I went and looked, and there's a ntlm_auth module now where I don't think there was one before. . . I had/have ntlm_auth defined in radiusd.conf exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=int.example.com --username=%{mschap:User-Name} --password=%{User-Password}" } Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

3 4

ldap machine accounts in good vlan
by cd 21 Jan '10

21 Jan '10

hello I have 2 samba domains (with ldap backend) Machine accounts are stored in ldap. I want to assign VLAN according to ldap server machine$ stored in ldap_server_1 must go in VLAN1 machine$ stored in ldap_server_2 must go in VLAN2 what is the method to assign VLAN on XP boot ?

1 0