- Freeradius-Users - lists.freeradius.org

DHCP-Relay-Agent-Information in reply
by Alexandr Sviridov 26 Nov '09

26 Nov '09

Hello I'm playing with freeradius dhcp support, and get the following problem. Freeradius 2.1.7, option 82, for dhcp snooping to work I have not only get DHCP-Relay-Agent-Information (option 82) in request but send it back to dhcp relay. Just test examle (radiusd in debug mode): DHCP-Discover: DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet ...skip... DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Relay-Agent-Information = 0x010600040001000202080006001e589e836f DHCP-Offer: Sending DHCP-Offer of id 69dd544f from 1.1.1.1:67 to 1.1.1.2:67 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet ...skip... DHCP-IP-Address-Lease-Time = 3600 DHCP-Relay-Agent-Information = 0x010600040001000202080006001e589e836f So far, so good, but tcpdump shows me: DHCP-Discover: Agent-Information Option 82, length 18: Circuit-ID SubOption 1, length 6: \000\004\000\001\000\002 Unknown SubOption 2, length 8: 0x0000: 0006 001e 589e 836f DHCP-Offer: Agent-Information Option 82, length 20: Unknown SubOption 0, length 18: So as I can see option 82 length is 20 instead of 18. Why? -- Alexandr Sviridov

2 2

Acct-Unique-Session-Id not unique!
by Vega Freeradius 26 Nov '09

26 Nov '09

Hi! Forgive me for by bad English. I've some problem with acctuniqueid. I use two freeradius server with two node mysql cluster. My freeradius version is "2.0.5". On both server threre is the same config. The modules/acct_unique content on both server is set to default: acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } But servers generate two different "uniqueid" from the same data! this is the START record (issued by first server) Thu Nov 26 15:00:45 2009 Acct-Status-Type = Start User-Name = "studioss(a)d.gbnetc.it" NAS-Identifier = "r-nl035" Acct-Session-Id = "erx atm 1/3.10083:1.83:0148107119" NAS-IP-Address = 217.141.253.49 Framed-IP-Address = 79.34.44.195 NAS-Port = 318832723 NAS-Port-Id = "atm 1/3.10083:1.83" Acct-Unique-Session-Id = "40f5c1e75a777864" this is the STOP record (issued by second server) Thu Nov 26 15:39:00 2009 Acct-Status-Type = Stop User-Name = "studioss(a)d.gbnetc.it" NAS-Identifier = "r-nl035" Acct-Session-Id = "erx atm 1/3.10083:1.83:0148107119" NAS-IP-Address = 217.141.253.49 Framed-IP-Address = 79.34.44.195 NAS-Port = 318832723 NAS-Port-Id = "atm 1/3.10083:1.83" Acct-Unique-Session-Id = "fb963455e99b780c" I delete some data before post it here. I see that User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port ar the same on both record. But Acct-Unique-Session-Id is different!!!! How this could be ? Thanks in advance Marco

2 1

Tie up user to specific NAS
by Deepak 26 Nov '09

26 Nov '09

Hi, How do I tie up user to specific NAS so that they can log in from that location only? I have different hotspots in different locations and using dynamic-clients? After a quick search, I found "NAS-Identifier" attribute. Is this the solution? If yes NAS-Identifier = ? (IP, MAC, Name) Thanks Deepak -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

3 3

how to decode CHAP and MS-CHAP passwords
by shivashankar 26 Nov '09

26 Nov '09

hi, i want to decode both(CHAP and MS-CHAP) passwords. why i want to do this is? i am sending username and password to java file to test authentication.there it is unable to understand that chap and ms-cahp encrypted data. before going to java file i will decode and convert to plain-text .so that java file can understand. plz help me -- View this message in context: http://old.nabble.com/how-to-decode-CHAP-and-MS-CHAP-passwords-tp26525242p2… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Exec and ntlm_auth
by Leighton Man 26 Nov '09

26 Nov '09

Hi Help again please! I've read the doc at http://deployingradius.com/documents/configuration/active_directory.html and I'm now confused again. I'm running version 2.1.7 so module configurations are now in a separate directory rather than modules.conf. I have an access request packet containing User-name and User-Password. Where do I configure the ntlm_auth command so I can authenticate against Active Directory (which, by the way, is giving me more pain than anything else I've dealt with for quite a while!!) Thanks, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 3

Re: Exec and ntlm_auth
by freeradius＠corwyn.net 25 Nov '09

25 Nov '09

At 10:45 AM 11/25/2009, Alan DeKok wrote: > What part of the instructions is not working for you? well for me at least, I have authentication working. radtest account password localhost 0 m3H1hc4Z1OtpNC2ZLX3A works fine. rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=164, length=20 However, when I try the same thing from the Cisco client, I get Authorization failed back from the cisco. Better, because I originally got back Authentication Failed, so I figure I'm one step farther. If I disable Authorization on the Cisco, or change it back over to my old tacacs+ server, I can log in successfully, so my problem is somewhere in the authorization process, which isn't really (to me) in that document. Yet the results from the log show freeradius sending back Sending Access-Accept of id 121 to 10.100.0.8 port 1812 rad_recv: Access-Request packet from host 10.100.0.8 port 1812, id=121, length=79 NAS-IP-Address = 10.100.0.8 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "username" Calling-Station-Id = "10.20.31.17" User-Password = "password" server server_cisco { +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "username", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry DEFAULT at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ntlm_auth +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=username [ntlm_auth] expand: --password=%{User-Password} -> --password=password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok Login OK: [rsteeves] (from client Cisco port 1 cli 10.20.31.17) +- entering group post-auth {...} ++[exec] returns noop } # server server_cisco Sending Access-Accept of id 121 to 10.100.0.8 port 1812 Rick

2 1

RE: Freeradius-Users Digest, Vol 55, Issue 113
by Peter Carlstedt 25 Nov '09

25 Nov '09

>

2 1

showing NAS-IP of 127.0.01 instead of
by Matt Ashfield 25 Nov '09

25 Nov '09

Hi, I'm running FreeRADIUS Version 2.1.5. We are trying to do system authentication for some users. Doing this by creating huntgroups based on NAS-IP-Address, and then telling that huntgroup to use System for authentication. The problem is that although the Access-Request packet is shown as coming from the correct host, that host's ip address is not showing up as the NAS-IP-Address for that request. Instead, it's showing as 127.0.0.1 as seen below: rad_recv: Access-Request packet from host 192.168.27.7 port 53201, id=130, length=51 User-Name = "xm7z1" User-Password = "abc.123" NAS-IP-Address = 127.0.0.1 I'm wondering what could cause this? Any help is appreciated. Thanks Matt

2 2

Free Radius accounting and duplicate session entries in radacct with different output/input octets
by Ade Slade 25 Nov '09

25 Nov '09

Hey, Firstly, is the accounting part of FreeRadius used by major organisations? Due to the possibility and indeed occurrence of duplicate sessions appearing in the radacct table and other issues I've found, it doesn't seem to be all that robust a solution. I realise freeradius is just reporting what it is sent from the NAS and so is not to blame. Secondly, I've experienced duplicate accounting sessions appearing which report different input/output octets. Over the set of the data, it has happened infrequently but it is undesirable. Comparing the data inserted into the radacct table and the logs, one (or more) of the duplicate sessions will reflect the logs and one of the duplicates will show completely different input/output octets. It's worth noting that these duplicate sessions share the same AcctSessionTime, AcctSessionId, AcctUniqueId and UserName. Any ideas on what the cause of this could be?

2 1

Groups of NASs by IP
by Leighton Man 25 Nov '09

25 Nov '09

Hi, I would like to group NASs by ip address but as I have a few hundred, I don't want to maintain a list. Can I configure ip address ranges in huntgroups eg. Group1 NAS-IP-Address == 192.168.1.101 - 105 If not, can I use regular expressions? How else can I do this? What is the best way? Thanks in advance, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 2