- Freeradius-Users - lists.freeradius.org

RES: Re: Defining Reply-Message for Access-Reject Packets
by Luiz Gustavo de Villa Scandelari 21 Jan '10

21 Jan '10

>Thu, 21 Jan 2010 10:02:48 +0700 EasyHorpak.com wrote: > >An HTML attachment was scrubbed... >URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2010012 1/98ccb1d7/attachment.html> Thanks so much EasyHorpak, it works now perfectly! LUIZ GUSTAVO DE VILLA SCANDELARI Skype: luiz.gustavo.wni

2 1

Can't Assign IP address my users
by Tevfik Ceydeliler 21 Jan '10

21 Jan '10

Hi Alain, > Also, the proxy isn't returning an IP address: >> Wed Jan 20 10:01:07 2010 : Info: [main_pool] Could not find Pool-Name attribute. >> Wed Jan 20 10:01:07 2010 : Info: ++[main_pool] returns noop That log is taken from test for static IP Here is the log for user who get IP address from pool : rad_recv: Access-Request packet from host 10.65.8.100 port 65401, id=2, length=56 User-Name = "tevfikceydeliler" User-Password = "172932808506" +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry tevfikceydeliler at line 216 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop +- entering group pre-proxy {...} expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok Sending Access-Request of id 236 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172932808506" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x32 Proxying request 1 to home server 10.1.1.51 port 1812 Sending Access-Request of id 236 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172932808506" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x32 Going to the next request Waking up in 0.9 seconds. OK ############################> rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=236, length=23 Proxy-State = 0x32 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} OK ############################>++[main_pool] returns noop expand: %{NAS-IP-Address} %{NAS-Port} -> 10.65.8.100 OK ############################>[birmas] MD5 on 'key' directive maps to: b6201c0efddb958ed955eb3c8b0d920a [birmas] Searching for an entry for key: 'b6201c0efddb958ed955eb3c8b0d920a' [birmas] Found a stale entry for ip: 172.30.64.95 [birmas] num: 0 rlm_ippool: Allocating ip to key: 'b6201c0efddb958ed955eb3c8b0d920a' [birmas] num: 1 [birmas] Allocated ip 172.30.64.86 to client key: b6201c0efddb958ed955eb3c8b0d920a ++[birmas] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok ++[exec] returns noop OK ############################>Sending Access-Accept of id 2 to 10.65.8.100 port 65401 OK ############################> Framed-IP-Address = 172.30.64.86 OK ############################> Framed-IP-Netmask = 255.255.240.0 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 2 with timestamp +44 Ready to process requests. There is no manual about how to set user for static ip address. Mostly configurations use password. But i use OTP (realm) as password. What is changed when user moved from pool so static ip? Tevfik Ceydeliler Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

Re: Can't Assign IP address my users
by Tevfik Ceydeliler 21 Jan '10

21 Jan '10

Hi again, Should The Framed Ip ( assigned to the user, framed IP) be in the main_pool in this case? Tevfik Ceydeliler wrote: > Hi Alain, > According your suggestion I delete " Packet-Type == Access-Request" -I wrote down to config according to SecOvid manual-, <shrug> The manual is wrong. > and,I dont think that problem is home server because home server accept requests when user IP comes from IP pool. Read the debug output: the home server is rejecting the user. Also, the proxy isn't returning an IP address: > Wed Jan 20 10:01:07 2010 : Info: [main_pool] Could not find Pool-Name attribute. > Wed Jan 20 10:01:07 2010 : Info: ++[main_pool] returns noop Go fix that. Alan DeKok. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

EAP Session resumption && reply attributes
by James J J Hooper 21 Jan '10

21 Jan '10

Hi All, When a client does session resumption: cache { enable = yes} in eap.conf The session User-Name (from previous access-accept) is restored from the cache e.g: [ttls] Skipping Phase2 due to session resumption [ttls] Adding cached attributes to the reply: User-Name = "ab1234" In order to also return e.g. VLAN IDs (that could be computed from the inner User-Name in a non-session-resumption enabled config), I can move the config that sets the VLAN to the outer tunnel post-auth && ensure the inner tunnel sets: reply:outer User-Name to request:inner User-Name and then key my VLAN computation (in outer post-auth) from reply:User-Name. I can see other possibilities to do this (e.g. cache Tunnel-Private-Group-Id in the TLS session cache), but the above seems ok to me. Can anyone on the list spot any problems, something that I've missed / gotchas with the above? Many thanks, James

4 9

Re: Can't Assign IP address my users
by Tevfik Ceydeliler 21 Jan '10

21 Jan '10

Hi Alain, According your suggestion I delete " Packet-Type == Access-Request" -I wrote down to config according to SecOvid manual-, and,I dont think that problem is home server because home server accept requests when user IP comes from IP pool.This problem happens for only user who wanna use static ip. All problem is, the user must static IP, cant connect. As you see the log below, radius asks sends request and home server accept in first request: ... ... Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 0.9 seconds. ##########HERE IS ACCESS ACCEPT >rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=107, length=24 Proxy-State = 0x3530 Wed Jan 20 10:01:07 2010 : Info: +- entering group post-proxy {...} Wed Jan 20 10:01:07 2010 : Info: [eap] No pre-existing handler found Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: Found Auth-Type = CHAP Wed Jan 20 10:01:07 2010 : Info: Found Auth-Type = Accept Wed Jan 20 10:01:07 2010 : Error: Warning: Found 2 auth-types on request for user 'tevfikceydeliler' >>>>>>>>>>>>>>>>>>>ERROR HERE Wed Jan 20 10:01:07 2010 : Info: Auth-Type = Accept, accepting the user Wed Jan 20 10:01:07 2010 : Info: +- entering group post-auth {...} Wed Jan 20 10:01:07 2010 : Info: [main_pool] Could not find Pool-Name attribute. Wed Jan 20 10:01:07 2010 : Info: ++[main_pool] returns noop Wed Jan 20 10:01:07 2010 : Info: [birmas] Could not find Pool-Name attribute. Wed Jan 20 10:01:07 2010 : Info: ++[birmas] returns noop Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 50 to 172.30.80.1 port 2005 Wed Jan 20 10:01:07 2010 : Info: Finished request 1. Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 4.9 seconds. ###########AGAIN ACCESS-REQUEST > rad_recv: Access-Request packet from host 172.30.80.1 port 1806, id=154, length=139 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 40329920 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Wed Jan 20 10:01:07 2010 : Info: +- entering group authorize {...} Wed Jan 20 10:01:07 2010 : Info: ++[preprocess] returns ok Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Wed Jan 20 10:01:07 2010 : Info: [chap] Setting 'Auth-Type := CHAP' Wed Jan 20 10:01:07 2010 : Info: ++[chap] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[mschap] returns noop Wed Jan 20 10:01:07 2010 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL Wed Jan 20 10:01:07 2010 : Info: [suffix] No such realm "NULL" Wed Jan 20 10:01:07 2010 : Info: ++[suffix] returns noop Wed Jan 20 10:01:07 2010 : Info: [eap] No EAP-Message, not doing EAP Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[unix] returns notfound Wed Jan 20 10:01:07 2010 : Info: [files] users: Matched entry tevfikceydeliler at line 219 Wed Jan 20 10:01:07 2010 : Info: ++[files] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[expiration] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[logintime] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[pap] returns noop Wed Jan 20 10:01:07 2010 : Info: +- entering group pre-proxy {...} Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Sending Access-Request of id 115 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 40329920 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Proxy-State = 0x313534 Wed Jan 20 10:01:07 2010 : Info: Proxying request 2 to home server 10.1.1.51 port 1812 Sending Access-Request of id 115 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 40329920 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Proxy-State = 0x313534 Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 10.1.1.51 port 1812, id=115, length=25 Proxy-State = 0x313534 Wed Jan 20 10:01:07 2010 : Info: +- entering group post-proxy {...} Wed Jan 20 10:01:07 2010 : Info: [eap] No pre-existing handler found Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: Using Post-Auth-Type Reject Wed Jan 20 10:01:07 2010 : Info: +- entering group REJECT {...} ... ... Then I dont know why but access request comes again. And home server (OTP server) looks itself and sees that this password is used before for this userand then reject it. İt is very normal beahviour for Home server. Because it is One Time Password server. ------------------------------ Message: 3 Date: Wed, 20 Jan 2010 12:58:28 +0100 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Can't Assign IP address my users To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4B56EFE4.1080900(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Tevfik Ceydeliler wrote: > Hi, > My problem is, If I try to assign a static I address to my user, I got error. > I have Secovid OTP server as realm. And my all users use token to create password. > In test case, when I try to connect to my radius server via gprs I see some error: > ... > .... > Wed Jan 20 10:01:07 2010 : Error: Warning: Found 2 auth-types on request for user 'tevfikceydeliler' > ... > ... > I did not edit DEFAULTS. > My users settings is here: > tevfikceydeliler Packet-Type == Access-Request , You don't need to check Packet-Type. Delete it. > Here is the my logs: > root@radiusII:/etc/freeradius# freeradius -Xxx Why "-Xxx" ? What's wrong with following the documentation? > rad_recv: Access-Reject packet from host 10.1.1.51 port 1812, id=115, length=25 > Proxy-State = 0x313534 Well... the home server rejects the user. Go fix the home server. Alan DeKok. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

RE: Can't Assign IP address my users
by Tevfik Ceydeliler 21 Jan '10

21 Jan '10

Hi Michael, All I want is that to give correct IP address to user. I have to use "Proxy-To-Realm" because my user dont use static password. They use token. And My realm is a OTP server. I care those two things. IP address and realm. What should I do? I really cant undertstand while user who use IP frpm poool can connect successfully, static ip users cant connect. Is there a trick? Tevfik Ceydeliler ------------------------------ Message: 3 Date: Wed, 20 Jan 2010 10:35:16 -0500 From: "Michael J. Hartwick" <hartwick(a)hartwick.com> Subject: RE: Can't Assign IP address my users To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <061401ca99e6$2a96bc90$7fc435b0$@com> Content-Type: text/plain; charset="utf-8" > Wed Jan 20 10:01:07 2010 : Error: Warning: Found 2 auth-types on > request for user 'tevfikceydeliler' > ... > ... > I did not edit DEFAULTS. > My users settings is here: > tevfikceydeliler Packet-Type == Access-Request , Proxy-To-Realm > := 10.1.1.51, Framed-IP-Address := 172.30.64.120 , Framed-IP-Netmask := > 255.255.255.255 Do you really want all of these as check items and no replies? Michael ---------------------------------------------------------------------- Michael J. Hartwick, VE3SLQ hartwick(a)hartwick.com Hartwick Communications Consulting (519) 396-7719 Kincardine, ON, CA http://www.hartwick.com ---------------------------------------------------------------------- Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

Authentication Failed
by Devinder Singh 21 Jan '10

21 Jan '10

Hi Ivan, I created the certificates basd on the README file in etc/raddb and copied ca.der and client.p12 to Windows XP I also also made changed to the Makefile which runs on XP but when i connect to the SSID i get authentication failde and the radius does not seem to get any response from the Proxim AP. -- Devinder

1 6

Defining Reply-Message for Access-Reject Packets
by Luiz Gustavo de Villa Scandelari 21 Jan '10

21 Jan '10

Hi, I have a Freeradius server v2.1.7 with mysql 5 in CentOs 5.3. The two situations I need to define reply messages are: 1) Username correct but wrong password; 2) Username and password wrong or just Username wrong; Thanks to Arran Cudbard-Bell and EasyHorpak.com, I was able to solve the first situation, but I have no ideas how to solve the second situation, because the rlm_sql module returns notfound ("User not found") and chap returns invalid causing a Access-Reject packet. Please can anyone give me an idea of how to solve that? Should I write some unlang at the sql or at the authorize section? Other point I need some help is about changing the dailycounter reply-message ("Your maximum daily usage time has been reached "). I don´t have also any idea howto do that. I´ve read in some emails that I should change the source code in order to get it working, is that right? Hope to receive some answer. Thanks, LUIZ GUSTAVO DE VILLA SCANDELARI Skype: luiz.gustavo.wni

2 1

How to set default ENVIRONMENT for programs runned from cron?
by Коньков Евгений 20 Jan '10

20 Jan '10

Hi If program runned from cron run another process like: curl or wget or anithign else located at PATH it says: can not find curl etc. NOTICE: when programm is runned from cron there is no PATH environment variable Does any know how to pass environment for programs runned from cron? -- mailto:kes-kes@yandex.ru

2 1

EAP-FAST
by Stefan Winter 20 Jan '10

20 Jan '10

Hello, every now and then there's a mild interest on this list about enabling EAP-FAST. In our eduroam R&D group, we are currently looking into EAP-FAST, which naturally includes FreeRADIUS support. Is it worthwhile posting our results here, for others "play with it" as well? Or has everybody already run away from the somwhat complicated installation of EAP-FAST support in FreeRADIUS [we certainly had our difficulties...] Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 4